Key Notes
- Binance says investigators found additional breach points beyond its initial compromised-laptop assessment.
- The exchange targets a withdrawal restart 45 hours after its October 30 update, while deposits remain unaffected.
- Around $3 billion is frozen as Binance pledges to cover all losses using SAFU and company funds.
Binance says its hack investigation has uncovered additional breach points beyond the compromised laptop identified in its initial assessment. The exchange is maintaining a target to restart withdrawals in 45 hours from its October 30 update, while reporting that roughly $3 billion in affected assets has been frozen.
In the investigation update, published at 08:47 UTC, Binance reiterated that it would cover all losses using its SAFU emergency fund and company funds. It assured customers that their funds were safe. Withdrawals were still suspended, while deposits remained unaffected.
Investigators Find Additional Breach Points
Binance’s earlier working assessment centered on a potentially compromised laptop. The latest statement broadens that account: investigators have identified further points of breach and are coordinating with law enforcement as they reconstruct the attack.
“Our subsequent investigation has uncovered additional points of breach,” Binance said.
The exchange has not described those additional points, named the affected systems or published a complete root-cause analysis in this update. Its initial laptop explanation therefore remains part of a developing investigation rather than an established account of the entire intrusion.
Binance also says the unauthorized outflows stopped when it suspended withdrawals. That is the company’s account of containment; it has not yet declared that the security overhaul is complete or that customers can withdraw again.
The 45-Hour Estimate Refers to Withdrawals
The countdown is tied to the 08:47 UTC statement on October 30. Counting forward 45 hours points to approximately 05:47 UTC on November 1, or 06:47 in Warsaw. This is an implied time calculated from Binance’s estimate, rather than a separately confirmed reopening appointment.
The company describes itself as remaining on track to restore the withdrawal service. The window is an operational target, not a promise that individual reimbursements or the recovery of all stolen assets will be completed within 45 hours.
An earlier service notice outlined a security revamp of the withdrawal service and its associated addresses, with an expected restart within 48 hours. The newer statement supplies the updated estimate while keeping deposits available.
About $3 Billion Is Frozen, Not Returned
Binance says it is continuing to work with partners to freeze affected assets and puts the amount restricted so far at around $3 billion. The latest notice does not identify a new token-by-token breakdown or say that those assets have already been returned to the exchange.
Freezing limits movement of assets where the relevant controls exist. It is separate from recovering the assets and from Binance’s commitment to absorb losses. The exchange’s pledge draws on both SAFU and company resources; the statement does not say SAFU alone will fund the entire response.
How This Updates the Earlier Hack Coverage
CoinScreamer’s earlier investigation report covered Binance’s preliminary $6.3 billion impact estimate, the first laptop assessment and the withdrawal suspension. The new statement adds breach points and a more recent service target without announcing a revised overall loss figure.
Our TRM attribution report separately examines the intelligence firm’s high-confidence assessment that North Korea’s TraderTraitor was responsible. Binance’s latest update does not announce a final attacker identification.
The recovery challenge also differs by asset. Our Bitcoin tracing follow-up explains why issuer freezes of stablecoins cannot be applied in the same way to native Bitcoin. Binance’s current message is that containment and restoration work continues, with withdrawals still awaiting reopening.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
