Binance Gradually Reopens Withdrawals After $6.3 Billion Multi‑Chain Hack

Overview

• The exchange says about $6.3 billion was drained in roughly 20–30 minutes during the October 29 attack when hot wallets on about 10 blockchains issued valid transfers.
• Investigators report the adversary first gained access in June through a tampered Homebrew package and then used convincing fake recruitment interviews in September to install malware and steal session tokens and credentials.
• The breach seized internal signing microservices and containers so withdrawals were cryptographically valid, and on Ethereum the attackers used an EIP‑7702 nonce‑guessing trick to delegate execution to a malicious contract.
• Binance froze withdrawals and deposits for about 45 hours, rebuilt signing infrastructure, and says it has fully reimbursed customers using SAFU, the Futures Insurance Fund and company capital while issuers froze roughly $2.5–$2.85 billion of the stolen assets.
• The FBI attributed the operation to a North Korean state‑linked group called TraderTraitor (Lazarus), a claim Pyongyang rejects, and on November 5 the exchange began phased re‑enabling of withdrawals for dozens of assets after security checks.