Binance Replenishes 90% of Stolen Assets, Targets Sunday

Update (Oct 31, 15:57 UTC): Binance has now replenished 90% of the $6.3 billion stolen in the recent security breach and is targeting Sunday to resume user withdrawals.

Update (Oct 31, 15:27 UTC): Circle Internet Group reported freezing over $800 million of USDC in coordination with law enforcement following the Binance security incident.

Attackers stole roughly $6.4 billion from Binance on Thursday in the largest crypto hack in history, more than four times the previous record. According to Decrypt, the breach began at about 4:05 p.m. ET, after U.S. markets closed, with funds moved out of hot wallets across roughly 10 blockchains within a 20-minute window.

Infrastructure Compromise and Attribution

Blockchain analytics firms Chainalysis and TRM Labs attributed the attack to TraderTraitor, a North Korea state-linked group. The breach targeted Binance's own infrastructure rather than the blockchains themselves. According to the exchange's investigation, the attacker compromised a DevOps engineer's laptop, used 50 pre-signed authorizations via Ethereum's EIP-7702 feature to turn a hot wallet into a sweeper contract, and utilized a self-destruct mechanism to wipe tooling traces.

Tether and Circle moved quickly to freeze funds, blacklisting addresses to lock down roughly $3 billion. However, the attacker still controls over 420,000 ETH and 18,270 BTC worth more than $3 billion that cannot be frozen by issuers.

Exchange Response and Market Impact

Binance CEO Richard Teng stated that the exchange will cover every dollar of the losses using company funds and its Secure Asset Fund for Users, noting that customer assets were never touched. The platform set aside more than $6.34 billion, holding about $5 billion of it in the exact tokens stolen, and aims to restore withdrawals by Sunday while publishing a complete proof of reserves by Monday.

Despite the massive scale of the theft, markets remained relatively composed. Bitcoin fell to about $76,400 on Friday, down roughly 4%, with more than $1.3 billion in leveraged positions liquidated.

Key facts

• Attackers drained roughly $6.4 billion from Binance hot wallets across 10 blockchains on Thursday.
• Chainalysis and TRM Labs attributed the hack to North Korea-linked group TraderTraitor.
• Tether froze more than $1.5 billion in USDT and Circle froze around $823 million in USDC.
• Binance CEO Richard Teng stated the exchange will cover all losses using company funds and its emergency reserve.
• Bitcoin traded down about 4% to roughly $76,400 following the incident.