Overview
- A rapid exploit on Thursday, Oct. 29 moved an estimated $6.3 billion from Binance hot wallets, with forensic firms saying much of the outflow occurred in about 20 minutes.
- Binance’s early probe points to a compromised DevOps engineer laptop and additional breach points that let attackers send delegated wallet authorizations and trigger an unverified ‘sweeper’ smart contract to extract funds.
- Industry partners including Tether and Circle froze roughly $2.5–3.0 billion on-chain by blocking large amounts of USDT, USDC and other tokens, while Binance suspended withdrawals and kept deposits largely open.
- Binance said it will make users whole using its Secure Asset Fund for Users (SAFU) and corporate resources and is working to restore withdrawals on the company’s expected 45–48 hour timetable as forensic work continues.
- Blockchain intelligence firms such as TRM Labs attribute the operation with high confidence to TraderTraitor, a group linked to North Korea, a finding not yet confirmed by Binance or law enforcement and one that raises fresh questions about centralized custody and market security.