The Yusuf İpek channel’s technology report examines the theft from Binance’s hot wallets on October 29. In its October 30 update, Binance put the loss at approximately $6.3 billion and said it would absorb the impact through its SAFU fund and corporate treasury.
Withdrawals through compromised infrastructure
Binance dated the incident to about 20:05 UTC. Its initial investigation pointed to a compromised laptop, while subsequent work identified additional compromise points. The exchange reported no evidence that wallet private keys had leaked; the investigation remained ongoing.
TRM Labs traced transfers across ten blockchains. Its analysis describes valid signatures and an Ethereum delegation that gave attacker-controlled code the ability to sweep a hot wallet. TRM attributed the incident to the North Korean group TraderTraitor.
Frozen assets and Binance’s coverage pledge
TRM’s snapshot at 00:30 UTC on October 30 counted roughly $2.7 billion frozen. Binance’s later update put the frozen total around $3 billion. These are differently timed figures; freezing funds is not the same as recovering them.
Binance said it had set aside more than $6.34 billion in company funds and was buying the remaining affected assets. Restoring withdrawals was tied to security checks, rather than an unconditional reopening deadline.
