Overview
- Late Thursday, October 29, blockchain forensics detected rapid, high‑frequency outflows from addresses labeled “Binance 14” and “Binance 16,” prompting Binance to suspend deposits and withdrawals and start a multi‑party investigation.
- Binance estimates the total impact at about $6.3 billion and says partners including Tether and Circle have frozen roughly $2.5–3.0 billion of the stolen assets on‑chain.
- Security researchers report the attackers used a delegated‑execution method that abused hot‑wallet permissions after compromising a DevOps engineer’s laptop and other breach points, sending a burst of signed authorizations that activated an unverified ‘sweeper’ contract.
- Binance has pledged to cover any user losses with its Secure Asset Fund for Users and corporate resources and says it aims to restore withdrawals after remediation within about 45–48 hours.
- TRM Labs has attributed the operation with high confidence to TraderTraitor, a North Korea‑linked group, but Binance and law enforcement have not officially confirmed that link and recovering remaining funds will require complex, cross‑jurisdictional work that could take months.