Overview
- Binance disclosed the breach on Thursday, October 30, saying hackers drained about $6.3 billion from a hot wallet and moved most funds within roughly 20 minutes.
- The FBI publicly attributed the theft to the North Korea‑linked TraderTraitor group and published roughly 500 Ethereum addresses for exchanges and services to block.
- Binance says it has mobilized about $6.34 billion of corporate funds to make customers whole and has replaced roughly 90–95% of the stolen value while starting phased withdrawal reopenings after security checks.
- Early investigations point to a complex, multi‑vector intrusion that began with a compromised engineer laptop and included use of an Ethereum delegation mechanism to seize control of the hot wallet.
- Partner exchanges and stablecoin issuers froze about half the stolen assets, but investigators warn attackers will try to launder remaining funds through ETH swaps and DeFi, a development that will intensify scrutiny of custody models, proof‑of‑reserves and AML controls.