✓ Verified by 7+ outlets BTCETHXRPSOLBNBTRXUSDT
Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor
🔴Bearish for $BNB, $BTCThe roughly $6.3 billion hack, the largest on record, has hit BNB and bitcoin and spilled over into other exchanges, though Binance says it has frozen about $2.85 billion and replenished about 98% of affected tokens with company funds.News sentiment, not financial advice. It reflects the likely impact of this news, not a price prediction.
Summary
Binance has confirmed a security breach in which billions of dollars in crypto were drained from its hot wallets on Oct. 29, put the estimated total impact at about $6.3 billion, and says it has set aside more than $6.34 billion of its own funds to cover user losses, CoinDesk, Cointelegraph and Decrypt reported.
Estimates of the size differ: Chainalysis put the amount stolen at $5.912 billion at the time of theft and an Arkham tracker showed about $5.84 billion in hack-linked wallets, Cointelegraph reported, while earlier on-chain tallies cited by Decrypt, The Block and CoinDesk ranged from about $3.55 billion to $5.8 billion.
Binance said it has worked with blockchain partners to freeze about $3 billion in affected assets, up from the $2.54 billion it cited earlier, with Tether, Circle, Ripple and World Liberty Financial among the issuers freezing tokens; withdrawals, suspended after the attack, began reopening in phases on Nov. 1 starting with the Bitcoin network, CoinDesk and Cointelegraph reported, while CoinDesk's live coverage cited about $2.5 billion frozen.
Decrypt reported that the attacker is swapping freezable stablecoins for ether on decentralized exchanges such as Uniswap and borrowing ETH on Aave, and CoinDesk reported that Binance's own reserve data lists the drained wallets as backing customer balances, leaving its ether backing an estimated 6% short until the stolen funds are replaced.
Binance said its initial investigation points to a compromised DevOps engineer's laptop and found no evidence of a private-key leak, Cointelegraph reported, and CEO Richard Teng later said the company found additional points of breach and that the attack was "not a single 'one-click' action," per Decrypt; TRM Labs (with "high confidence") and Chainalysis have attributed the attack to North Korea's TraderTraitor group, the outlets reported, and on Oct. 31 the FBI said in a statement that TraderTraitor was behind the theft, CoinDesk and the AP reported; Binance has not itself named the attackers.
Updates
- Update, : Update (Oct. 29, evening): Binance confirmed the breach, pledged to cover all losses, suspended withdrawals and deposits, and said $2.54 billion has been frozen so far; Chainalysis estimated $5.912 billion stolen. Ripple and World Liberty Financial joined Tether and Circle in freezing tokens (CoinDesk, Cointelegraph, Decrypt, Bitcoin Magazine).
- Update, : Update (Oct. 29, night): Binance put the hack at about $6.3 billion, said roughly $3 billion is frozen, and traced the breach to a compromised DevOps engineer's laptop with no sign of a private-key leak. Researchers cited by CoinDesk suspect North Korea's Lazarus Group; bitcoin fell below $77,000 and BNB lost 7.1% (Cointelegraph, CoinDesk, The Block).
- Update, : Update (Oct. 30, morning): Binance says it has set aside more than $6.34 billion to cover losses, $5 billion of it already in the stolen tokens, and has found additional points of breach. TRM Labs and Chainalysis attribute the hack to North Korea's TraderTraitor; the 18,270 stolen BTC sits unmoved in 19 wallets; liquidations hit $1.57 billion and CoinDCX curbed new futures (CoinDesk, Cointelegraph, Decrypt).
- Update, : Update (Oct. 30, late morning): Binance is working with the FBI to recover about $3 billion in frozen assets (Cointelegraph). CoinDesk reported the attacker used Ethereum's EIP-7702 upgrade and 50 signatures from Binance's own wallet to drain part of the funds, and Wall Street analysts at Cantor Fitzgerald, TD Cowen and Compass Point said the hack is unlikely to derail the market's recovery.
- Update, : Update (Oct. 30, midday): CEO Richard Teng said the hackers erased evidence and bypassed security checks; CoinDesk reported Binance is targeting a Sunday restart of withdrawals and will publish proof of reserves Monday. The FBI and, per a Reuters source cited by Decrypt, the Secret Service are involved in the probe, while Circle said it froze more than $800 million in USDC.
- Update, : Update (Oct. 30, afternoon): President Trump said he is looking into the hack, and CFTC Chair Michael Selig said it shows why offshore exchanges need U.S. oversight, as industry groups and lawmakers pushed Congress to pass crypto market rules, The Block and Decrypt reported. CoinDesk reported legal experts are split over the rapid asset freezes.
- Update, : Update (Oct. 30, evening): Bitcoin Magazine said about $3.3 billion of the stolen funds remains unrecovered, Cointelegraph detailed how the attackers rushed to swap freezable stablecoins, and Decrypt reported Wall Street analysts see the hack as a Binance security failure rather than a crypto-wide threat.
- Update, : Update (Oct. 31, morning): CoinDesk noted the 18,270 stolen BTC (about $1.4 billion) exceeds Tesla's holdings, and Cointelegraph reported the hack has become a pre-election talking point, with Sen. Lummis citing the Clarity Act and Rep. Waters criticizing deregulation. Binance says it will publish a technical postmortem.
- Update, : Update (Oct. 31, midday): Binance says it has replenished 90% of the stolen assets, up from about 80% a day earlier, using corporate funds, futures reserves and SAFU, and is on track to resume withdrawals Sunday, CoinDesk and Cointelegraph reported.
- Update, : Update (Oct. 31, evening): The FBI said North Korea's TraderTraitor group was behind the hack and, with the Secret Service and IRS-CI, urged exchanges, DeFi services, node operators and analytics firms to block transactions tied to more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address it listed. Chainalysis CEO Jonathan Levin said the attackers have already used thousands of addresses (CoinDesk, AP).
- Update, : Update (Nov. 1): Binance began reopening withdrawals in phases, starting with the Bitcoin network. It said it is prioritizing tokens by the past week's user demand and warned of congestion, longer processing times and temporary delays during the rollout (CoinDesk, Cointelegraph).
- Update, : Update (Nov. 1): After reopening withdrawals, Binance said it saw $3.64 billion in net outflows, equal to 2.1% of its $171 billion in assets, and that withdrawal volumes have declined after an initial spike (The Block).
- Update, : Update (Nov. 1): North Korean hackers have laundered about $242 million of the stolen Binance funds via Tron, according to an analyst cited by The Block, with bridges Relay, THORChain, Chainflip and Symbiosis moving about $140 million off Tron (Relay the most, at $48 million). The Block also reported the FBI is pressing THORChain.
- Update, : Update (Nov. 1, evening): Cointelegraph reported Binance's net outflows have reached $5.8 billion since withdrawals resumed, higher than the $3.64 billion figure The Block reported earlier in the day; Binance says withdrawals surged after some services resumed but have since slowed, and the outflows are a fraction of its roughly $171 billion in customer assets. Separately, THORChain node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, after a block reorg bug, which Cointelegraph said is slowing the Binance hackers.
- Update, : Update (Nov. 1, night): U.S. spot bitcoin ETFs saw about $643 million in outflows on Friday, the first full trading session after the hack, according to both The Block and Decrypt. The Block said it was the largest single-day outflow since June 25; Decrypt said the funds ended October with roughly $516 million in net outflows.
- Update, : Update (Nov. 2, morning): Binance said it has replenished about 95% of the stolen assets and tapped about half of its SAFU bitcoin wallet, and net outflows topped $7 billion per DefiLlama data cited by Cointelegraph. Lookonchain reported the hackers are now swapping about $46.4 million in stolen SOL for bitcoin, and CoinDesk reported Elliptic found no evidence the laundering used AI agents.
- Update, : Update (Nov. 2, midday): Binance completed a new zero-knowledge proof of reserves covering 10 assets including XRP and said it will restore withdrawals for more networks on Tuesday, The Block and Bitcoin Magazine reported. The Block said 24-hour net outflows have eased to about $3.29 billion from a peak near $7 billion, per DefiLlama.
- Update, : Update (Nov. 2, afternoon): Decrypt reported that $2.85 billion of the $6.43 billion stolen has been frozen or seized, versus about 3% in the Bybit hack, as North Korea's automated laundering spreads across some 12,000 wallets, about one new wallet every 25 seconds. Decrypt's total differs from Binance's own estimate of about $6.3 billion and from the roughly $3 billion frozen figure Binance cited earlier.
- Update, : Update (Nov. 2, late afternoon): North Korea is now reportedly denying it was behind the hack, with Kim Jong Un's sister rejecting the FBI's finding that North Korean hackers carried it out, The Block reported, citing other reports.
- Update, : Update (Nov. 2, evening): Cointelegraph also reported Pyongyang's pushback against the FBI's attribution, saying Kim Yo Jong called the U.S. allegations politically motivated.
- Update, : Update (Nov. 2, night): Binance has begun a second phase of reopening withdrawals, with additional assets becoming available from 04:00 UTC on Tuesday as security checks are completed, following the initial reopening on Sunday, Cointelegraph reported. Cointelegraph also said outflows from the exchange have slowed.
- Update, : Update (Nov. 3, morning): Customers withdrew $10.97 billion in the 46 hours after the hack, with withdrawals exceeding deposits by $5.28 billion, according to blockchain data CEO Richard Teng shared, CoinDesk reported; by 03:00 UTC Tuesday hourly deposits exceeded withdrawals by about $10 million. Cointelegraph, citing DefiLlama, reported $2.3 billion in 24-hour net inflows to Binance after more than $7 billion in net outflows on Monday; the two outlets use different time windows. CoinDesk also reported that Binance's SAFU user-protection wallet now holds just above 7,500 BTC, about $580 million and down from 15,000 BTC in February, and that Binance has pledged to restore the fund to about $1 billion without giving a timeline. CoinDesk separately reported that Arbitrum's 12-member Security Council moved $30 million of the stolen funds without the hacker's key by briefly changing a core contract. CoinDesk and Decrypt added that North Korea has denied involvement, with Decrypt saying it called the FBI finding a 'political provocation.'
- Update, : Update (Nov. 3, midday): Binance published an initial incident report saying the hack began with a fake job interview, CoinDesk, The Block, Cointelegraph and Bitcoin Magazine reported. According to the report, an engineer was approached in September by people posing as company executives and told to download a coding assignment that infected his work computer; CoinDesk said it carried zero-day malware that evaded endpoint security. A separate engineer had installed a tampered Homebrew package in June while looking for an AI coding tool. On Oct. 20 the attackers used the compromised machine and an internal AI tool to reach two wallet engineers' computers, and on Oct. 29 used stolen credentials to deploy a container and run the script that launched the wallet attack. Chief security officer Jimmy Su said the attacker used Ethereum's EIP-7702 feature to gain execution rights over a hot wallet, and containment took until 00:10 UTC on Oct. 30, CoinDesk reported. Binance said about $2.85 billion has been frozen, about 98% of affected tokens have been replenished with company funds, it blocked 57 suspected North Korea-linked attempts this year, and it is commissioning an independent security review.
- Update, : Update (Nov. 3, afternoon): Binance founder Changpeng Zhao, in interviews with CoinDesk and the Talking Tokens podcast reported by The Block, warned AI will drive more hacks on exchanges and banks and called for an industry security alliance to share best practices and freeze funds faster. CoinDesk noted Zhao gave no evidence of AI involvement and that Elliptic sees automated, not AI-directed, laundering. Zhao told CoinDesk the initial $3.6 billion in outflows was about 2% of Binance's holdings, and said Tether, Circle, law enforcement and the U.S. Secret Service helped freeze funds.
- Update, : Update (Nov. 3, evening): THORChain, whose weekend halt had slowed the hackers' laundering, restarted swaps on most chains on Nov. 3, including Bitcoin, Ethereum and Tron, Unchained and Cointelegraph reported; BNB Smart Chain, Cosmos Hub and Solana remained paused and THORChain had not announced the restart or a date for the rest, per Unchained. Cointelegraph counted 10 of 13 external networks marked OK. Separately, South Korean President Lee Jae Myung cited the hack in calling for a government-wide cybersecurity czar, CoinDesk reported, citing The Korea Times.
- Update, : Update (Nov. 4): The attackers have moved about 81% of the 970,522 SOL stolen, with wallets tied to them holding 182,443 SOL (about $16.9 million), Cointelegraph reported citing Arkham; Lookonchain said the SOL was sold for USDC, bridged to Ethereum for ether, and then swapped for bitcoin via THORChain after the protocol resumed swaps. CoinDesk also reported that North Korea's TraderTraitor is routing proceeds through THORChain, swapping ether for bitcoin, and said THORChain's RUNE token jumped 10%.
- Update, : Update (Nov. 4): Coinbase said 99% of its customer assets sit in cold storage and that it was not affected by the Binance hack, The Block reported.
- Update, : Update (Nov. 5): Federal Reserve and OCC supervisors began contacting U.S. banks on Monday to ask about unusual activity or service disruption after the Binance hack, Bitcoin Magazine reported citing Reuters; one contacted bank said it saw no disruptions, and neither regulator has announced new guidance. Binance said it was not aware of those conversations and is in close contact with regulators worldwide.
- Update, : Update (Nov. 5, afternoon): Cointelegraph also reported that U.S. regulators contacted banks after the hack, as experts raised concerns about transaction security and crypto risks.
- Update, : Update (Nov. 6): Elliptic told Decrypt about $3.11 billion of the roughly $6.43 billion Binance haul still sits in theft-linked addresses (mostly ETH and BTC), with about $2.85 billion frozen or seized—mostly stablecoins—and laundering already spanning more than 20,000 wallets on 16 chains; Bitcoin Magazine said about $50 million of stolen XRP (~42 million XRP) has been swapped mostly via THORChain into bitcoin, with ~192 million XRP (~$226 million) still unswapped and converted BTC from stolen assets near 1,650 BTC (~$124 million). Separately, Cointelegraph reported Security Alliance estimates TraderTraitor had about eight weeks of access before the Oct. 29 exploit and flagged front companies used in fake recruitment campaigns.
- Update, : Update (Nov. 6, 3pm): The Block, citing Elliptic, said attackers have swapped about $124 million of stolen altcoins into bitcoin on top of the ~$1.48 billion in BTC taken in the breach, with nearly all stolen SOL already mixed, swapped or bridged; Elliptic still sees only a "negligible" cash-out and rejects claims that AI agents are directing the laundering. The Block also reported Binance said on X it aims to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of next week and for all tokens on already-restored networks including ETH, BSC, Arbitrum and Optimism.
- Update, : Update (Nov. 7, afternoon): Binance CFO Kaiser Ng is stepping down and will be replaced by Justin Yek, a former vice president of finance at payments firm Airwallex, co-CEO Yi He said in a statement Saturday, The Block reported, citing Bloomberg and Reuters. Yi He said Ng, CFO since January 2022, is leaving to pursue a new venture under a transition plan put in place over the past six months; the statement did not give a departure date. The change comes nine days after the Oct. 29 hack.
- Update, : Update (Nov. 9): Elliptic says the North Korean hackers behind the Binance theft are minting their own memecoins to launder loot, using six homemade tokens to move 117,000 NEAR (about $430,000), CoinDesk reported; The Block said the tokens include Elon Musk and animal-themed coins, and that Elliptic says the extra swaps slow investigators down but the stolen funds remain traceable onchain.
- Update, : Update (Nov. 9): Bitcoin Magazine and Decrypt also reported Elliptic's findings; Bitcoin Magazine said the six throwaway tokens were created on NEAR between Nov. 5 and 7 and moved about $430,000 through homemade liquidity pools.
- Update, : Update (Nov. 9, evening): Analysts told Cointelegraph they see no broader contagion from the hack because Binance can cover losses from its balance sheet; Binance's daily net outflows fell to $458 million from $6.1 billion on Nov. 2, per DefiLlama data cited by Cointelegraph.
- Update, : Binance says it has fully covered the $6.34 billion loss with company funds, per Bitcoin Magazine.
- Update, : The DOJ says it has court approval to seize more than $1.2 billion of the stolen funds, part of $2.7 billion frozen so far (The Block).
- Update, : Bitcoin Magazine adds that the $1.2 billion is part of funds already frozen, not new recoveries, and that the DOJ says tracing continues.
Key facts
- Decrypt reported that an address funded through Tornado Cash installed an EIP-7702 delegation on a Binance hot wallet three minutes before the first Ethereum transfer at 20:24 UTC, which sent 167,464 ETH and 63 tokens including 1.615 billion USDT to a new address; how the attacker got the required signature is unknown.
- Decrypt's tally counts $3.51 billion on Ethereum, $1.44 billion in 18,270 BTC and $630 million on Tron.
- Earlier freeze figures differ: Decrypt reported Tether froze 975.1 million USDT and Circle 823 million USDC in the main receiving wallet, about $1.8 billion; The Block said on-chain data showed a combined $1.79 billion before Ardoino announced the larger 1.567 billion USDT figure; Cointelegraph said the two issuers' announcements total more than $2.36 billion.
- The exploiter borrowed 20,000 wrapped ETH (about $44 million) on Aave using stolen USDT as collateral, CoinDesk reported; The Block said on-chain data shows Aave froze lending markets to stop further borrowing, though the protocol had not issued a statement.
- Blockaid said it is investigating about $3.3 billion in suspicious outflows from Binance hot wallets across Ethereum, Arbitrum and Avalanche, according to The Block.
- Blockchain researcher Spreek first flagged the transfers on X, Cointelegraph reported.
- Bitcoin fell to about $78,800-$79,000 and BNB dropped roughly 6-7%, CoinDesk and Decrypt reported, while Decrypt said privacy coin Monero rose about 6%.
- If confirmed, the losses would be more than triple the roughly $1.5 billion Bybit hack of February 2025, the previous record, Decrypt noted.
- Binance said the verified total frozen is $2.54 billion and could increase as investigators trace more assets, clarifying figures such as $1.8 billion circulating earlier.
- Binance said it will “cover all losses” and share a full post-mortem once the investigation is complete; it temporarily suspended withdrawals, deposits and Binance Alpha trading.
- Chainalysis estimated $5.912 billion was stolen at the time of theft, about four times the 2025 Bybit theft, Cointelegraph reported.
- Ripple froze about $200 million in RLUSD, according to Binance co-CEO Yi He, Decrypt reported; Ripple's Jack McDonald confirmed it was freezing affected funds but did not give an amount.
- World Liberty Financial froze $27 million in USD1 and $2 million worth of WLFI, working with BitGo, Cointelegraph reported.
- About 253,000 ETH, roughly $570 million, sat in two attacker wallets with no outgoing transfers as of 22:07 UTC, Decrypt reported, noting ETH has no issuer that can freeze it.
- Aave froze its community-governed V3 and V4 markets as a precaution, pausing new deposits and borrowing while still allowing withdrawals and repayments, and said its contracts were unaffected, Cointelegraph reported; Decrypt said Kamino also paused its SOL/BTC market.
- Market makers Wintermute and GSR disclosed exposure to Binance of less than 20% and less than 5% of net equity respectively and said they did not expect major disruption, Cointelegraph reported.
- Blockaid said the attacker bundled 50 EIP-7702 authorizations into one transaction targeting a Binance wallet, one of which matched the account's required nonce, Cointelegraph reported.
- Bitcoin Magazine said bitcoin traded at $78,800, down 2.89% over 24 hours, after hitting a low of $78,177; CoinDesk's summary said bitcoin fell back to $77,000, and Cointelegraph said BNB fell 7% and the broader crypto market 3.3%.
- Binance said its preliminary investigation points to a compromised DevOps engineer's laptop, which may have allowed access to a service container and unauthorized withdrawal transactions; it found no evidence of a wallet private-key leak and revoked the affected address authorization.
- Binance put the estimated total impact at around $6.3 billion, said about $3 billion has been frozen onchain, and pledged to cover losses with its SAFU fund and company funds and to publish an updated Proof of Reserves.
- Security researchers suggested North Korea's Lazarus Group was behind the hack, CoinDesk reported; this attribution comes from outside researchers, not Binance.
- BNB lost 7.1% and bitcoin slid below $77,000, while Binance co-CEO Yi He pledged the exchange will cover all user losses, The Block reported.
- CoinDesk reported institutional crypto investors rushing to pull funds from exchanges after the hack, suggesting the fallout is spreading beyond Binance.
- Standard Chartered said crypto prices may remain under pressure before finding a base, CoinDesk reported; the bank's Geoffrey Kendrick told Cointelegraph the breach could accelerate a shift toward decentralized trading.
- Binance said it set aside more than $6.34 billion in company funds to cover losses, with $5 billion already held in the same tokens that were stolen; a spokesperson said the holdings will appear in its next proof-of-reserves report but declined to share wallet addresses.
- The roughly $3 billion in frozen assets is excluded from the funds set aside, and Binance has not said which tokens it still needs to buy or how much has been recovered, Cointelegraph reported.
- CEO Richard Teng said the attack was "not a single 'one-click' action" as Binance disclosed additional points of breach and confirmed about $3 billion frozen, Decrypt reported.
- Chainalysis CEO Jonathan Levin said the hack, which he put at $6.4 billion, was likely done by North Korea's TraderTraitor, and ZachXBT said funds from the Binance and earlier Bitget hacks converged at the same address after moving through THORChain, Cointelegraph reported.
- TRM Labs said funds were drained from Binance wallets across 10 blockchains, Cointelegraph reported; Decrypt said both TRM and Chainalysis blame the group behind the 2025 Bybit hack.
- A CoinDesk blockchain trace found all 18,270 stolen bitcoin, about $1.4 billion, sitting in 19 wallets, 17 of them holding exactly 1,000 BTC each, with none moved since Thursday night; bitcoin cannot be frozen by an issuer.
- Crypto futures liquidations jumped to $1.57 billion as bitcoin traded near $77,350, CoinDesk reported.
- India's CoinDCX restricted new futures positions after the incident disrupted a key liquidity provider, saying deposits, withdrawals and customer funds were unaffected, CoinDesk reported.
- Binance is working with law enforcement, including the FBI, to recover the roughly $3 billion that has been frozen, Cointelegraph reported.
- On Ethereum, the attacker used EIP-7702, a 2025 upgrade that lets ordinary wallets run smart-contract code, armed with 50 signatures from Binance's own wallet, CoinDesk reported; Decrypt also tied the hack to EIP-7702.
- The Block reported that Binance has allocated $6.34 billion to cover losses while industry partners have frozen another $3 billion in affected assets.
- Analysts at Cantor Fitzgerald, TD Cowen and Compass Point said the hack is unlikely to derail the crypto market's recovery, CoinDesk reported.
- CEO Richard Teng said the hackers erased evidence and bypassed security checks; CoinDesk reported Binance is targeting a Sunday restart of withdrawals and plans to publish its proof of reserves on Monday.
- Teng said the attacker used a self-destruct mechanism and an EIP-7702 delegation that bypassed Binance's normal approval controls, Decrypt reported.
- The FBI said it was aware of the incident and working with public and private partners, and a person familiar with the matter told Reuters the Secret Service is also involved, Decrypt reported; the Secret Service did not comment.
- Circle CEO Jeremy Allaire said Circle has frozen more than $800 million in USDC tied to the incident, and Tether froze about $1.5 billion in USDT, Decrypt reported.
- Decrypt noted bitcoin fell about 3% after the hack, compared with nearly 11% in 2018 when Binance was last attacked.
- After Elon Musk appeared to mock the hack on X, Binance founder Changpeng Zhao replied that Binance's $500 million bet on Musk's Twitter takeover is now worth over $1 billion in SpaceX shares, Decrypt reported.
- President Donald Trump said at a Friday press conference that he was looking into the hack, adding that Binance has said it is ensuring customers get their funds back, The Block reported.
- CFTC Chair Michael Selig told CNBC the breach "proves our exact point" behind the agency's proposed crypto rules, arguing offshore exchanges should be able to register with the CFTC and meet U.S. cybersecurity standards, Decrypt and The Block reported.
- Selig said the exploit did not break Ethereum or its smart contracts but a vulnerability he believed was "introduced from someone's laptop"; Decrypt noted Binance has since said the attack "did not simply use one engineer's permissions."
- The Digital Chamber CEO Cody Carbone sent a letter to House and Senate leaders urging Congress to immediately pass a bill giving the CFTC authority over crypto exchanges, and Sen. Cynthia Lummis said the Clarity Act would have given firms legal cover to freeze suspicious transactions; Better Markets' Amanda Fischer disputed that, The Block reported.
- Legal experts are divided over the rapid freezes of stolen funds by Tether, Circle and others, questioning whether smaller victims would get the same protection and warning that recovering the funds is another matter, CoinDesk reported.
- The Block published an explainer on how the attackers compromised Binance's hot-wallet signing infrastructure, saying investigators tie the hack to North Korea.
- Cointelegraph Magazine reported the attackers raced to convert stolen stablecoins into crypto that issuers could not freeze while Tether, Circle and others moved to immobilize billions of dollars in assets.
- Analysts at Cantor Fitzgerald, TD Cowen and Compass Point called the theft, which Decrypt put at $6.4 billion, a Binance security failure rather than a crypto-wide threat and pointed clients toward stock-market proxies such as Coinbase, Robinhood and Strategy, Decrypt reported.
- Bitcoin Magazine said $3.3 billion of the roughly $6.3 billion taken remains unrecovered.
- CoinDesk said the 18,270 BTC taken in the hack, worth about $1.4 billion, is more than Tesla holds, over twice El Salvador's reserve, and within 442 coins of SpaceX's disclosed holdings.
- CoinDesk reported the hack has revived the debate over decentralization, noting centralization made the hack possible but also helped freeze about $3 billion.
- With the US election on Nov. 3, Sen. Cynthia Lummis said the stalled Clarity Act would have given crypto firms legal cover to freeze suspicious transactions, while Rep. Maxine Waters called the hack a wake-up call and criticized Republicans' deregulatory push and the Trump family's ties to Binance, Cointelegraph reported.
- Binance said it will publish a detailed technical postmortem after a full security review, according to Cointelegraph.
- Binance said Saturday it had replenished 90% of the assets stolen in the hack, up from about 80% a day earlier, and remained on track to resume withdrawals Sunday, Cointelegraph reported.
- CoinDesk reported Binance is absorbing all losses through corporate funds, futures reserves and its SAFU fund, keeping user balances intact.
- Cointelegraph said less-liquid tokens make up the remaining shortfall, and Binance is still buying replacement assets through market and over-the-counter trades.
- Strive CEO Matt Cole said bitcoin held up better than expected after the hack and that it has not changed his long-term case for bitcoin, but cautioned it is too early to call a market bottom, Cointelegraph reported.
- The FBI said Saturday, Oct. 31, that North Korea's TraderTraitor group, the same actors behind the 2025 Bybit hack, carried out the Binance theft, the AP reported.
- The FBI, Secret Service and IRS-CI urged THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other crypto service providers to block transactions with addresses the attackers are using; the notice listed over 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address, and said the funds are being converted mainly into ether, CoinDesk reported.
- Chainalysis CEO Jonathan Levin said the attackers have already used thousands of addresses and expects that to grow to tens of thousands in the coming weeks as the funds move through a wider laundering network, CoinDesk reported.
- Binance said on X that the Bitcoin network is the first opened in phase one of withdrawals, and that it is prioritizing tokens based on the past week's user demand so each network and asset pair can be restored after stability and security checks, Cointelegraph reported.
- Binance said users should check the withdrawal page for their asset and network or its network status page, and that congestion, longer processing times and temporary delays are expected during the phased rollout, Cointelegraph reported.
- Binance said net outflows after reopening withdrawals reached $3.64 billion, equal to 2.1% of its $171 billion in assets, and that withdrawal volumes declined after an initial spike, The Block reported.
- An analyst cited by The Block said North Korean hackers laundered about $242 million of the Binance loot via Tron, and that bridges Relay, THORChain, Chainflip and Symbiosis moved about $140 million of it off Tron, with Relay handling the most at $48 million.
- Cointelegraph reported Binance's net outflows surged to $5.8 billion as withdrawals resumed, a fraction of its roughly $171 billion in customer assets; Binance said withdrawals surged at first but have since slowed. That is higher than the $3.64 billion The Block reported earlier on Nov. 1.
- THORChain node operators paused swaps involving assets on 10 networks, including Bitcoin, Ethereum, Solana and Tron, after a block reorg bug, which Cointelegraph said slows the Binance hackers.
- U.S. spot bitcoin ETFs shed $643 million on Friday, their largest single-day outflow since June 25, following Thursday's Binance hack.
- Bitcoin ETFs saw $643.2 million in outflows Friday, the first full trading session after the Binance hack, and ended October with roughly $516 million in net outflows.
- Binance said it had replenished about 95% of the affected assets by Sunday, up from 90% a day earlier, and transferred 7,499 BTC out of its SAFU emergency wallet, leaving about 7,500 BTC (about $583 million) there.
- Binance's net outflows topped $7 billion by Monday per DefiLlama, while OKX led exchanges with about $445 million in 24-hour net inflows.
- Lookonchain said the hackers moved 486,970 SOL (about $46.4 million) and were swapping it for bitcoin via Relay; Chainalysis said most Tron holding wallets had been emptied, and exchange Gate said it froze two linked accounts.
- Elliptic tracked thousands of transfers, failed swaps and repeated transactions that suggest the hackers relied on scripts rather than AI agents.
- Binance completed a zero-knowledge proof of reserves for its Oct. 31 snapshot, letting holders of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC verify 1:1 backing; another snapshot is planned for Wednesday, Nov. 4, with the proof taking about 40 to 50 hours.
- Binance said it will start restoring withdrawals for more networks and assets on Tuesday; the remaining 5% of losses are in less-liquid tokens it is still buying.
- Binance's 24-hour net outflows fell to about $3.29 billion, down more than 50% from a peak near $7 billion, per DefiLlama.
- $2.85 billion of the $6.43 billion stolen from Binance has been frozen or seized, compared with about 3% in the Bybit hack, and North Korea's automated laundering spans about 12,000 wallets.
- Changpeng Zhao called for an industry security alliance to share lessons, run cross-audits and help freeze stolen funds faster, saying the threat is "definitely at the national security level."
- Elliptic said the laundering of the stolen funds appears automated but showed no AI agent making decisions, and Zhao offered no evidence AI played a role in the attack.
- THORChain switched swaps back on for most chains halted after the Oct. 31 Ethereum reorg on Nov. 3, including Bitcoin, Ethereum and Tron, while BNB Smart Chain, Cosmos Hub and Solana stayed halted, according to THORNode data read by Unchained and THORChain's status page cited by Cointelegraph.
- South Korean President Lee Jae Myung cited the Binance hack in calling for a "powerful cybersecurity czar" to coordinate security across public agencies and private businesses; no timetable has been set.
- Elliptic says the hackers used six homemade memecoins to launder 117,000 NEAR, worth about $430,000.
- Elliptic says the memecoin swaps slow investigators down, but the stolen funds remain traceable onchain.
- Bitcoin Magazine: Elliptic says North Korean launderers created six throwaway meme tokens on NEAR between Nov. 5 and 7, moving about $430,000 of stolen Binance funds through homemade liquidity pools.
- Cointelegraph: Elliptic traced stolen funds through six new tokens on NEAR, where the hackers used liquidity pools to obscure transfers between wallets.
- Cointelegraph: bitcoin fell as much as 5.7% over the first five days after the hack, a decline CryptoQuant called "modest" compared with about 13.6% after the 2025 Bybit hack.
- Bitcoin Magazine: Binance says users are whole after the Oct. 29 theft, paid from SAFU, its futures insurance fund and treasury, and it published a 198-token proof-of-reserves snapshot that users cannot yet independently verify.
- The DOJ said it has court approval to seize or restrain more than $1.2 billion stolen in the hack, part of more than $2.7 billion frozen by U.S. authorities and private companies, and attributed the theft to North Korea's TraderTraitor group.
- Bitcoin Magazine notes the DOJ put the theft at more than $6 billion, below the $6.34 billion Binance has covered, and that the $1.2 billion under court authority comes out of funds already frozen rather than newly recovered money; the DOJ said the attackers are still moving assets through bridges, mixers and exchanges.