Binance said it has set aside more than $6.34 billion to cover losses from a roughly $6.3 billion cryptocurrency theft, as investigators and rival exchanges on Friday focused on the systems that authorize transactions. The exchange’s latest update says it is purchasing replacement tokens, keeping withdrawals suspended during security checks and preparing new reserve disclosures.
The company’s official update says more than $5 billion in corresponding token assets is already in place, representing about 80% of the stolen holdings. Those are company statements, not an independently completed verification of restitution. Binance says withdrawals will resume in phases and plans to publish its initial proof-of-reserves results by Monday, Nov. 2.
The developing evidence points to a problem broader than a stolen password or a single compromised laptop. Analysts say attackers appear to have obtained access to infrastructure capable of approving transfers across multiple blockchains. Binance has acknowledged additional intrusion points but says it has found no evidence that wallet private keys were compromised.
The authorization system becomes the target
Blockchain investigator TRM Labs traced approximately $6.36 billion leaving Binance wallets, with most moving in about 20 minutes beginning at 20:05 UTC on Oct. 29. Its analysis valued transfers at the assets’ prices when taken. The firm identified coordinated movements across different networks and assessed that the exchange’s hot-wallet signing infrastructure had been compromised.
A hot wallet is used for active transactions, unlike an offline store of keys. In TRM’s interpretation, the attacker obtained the ability to make Binance’s systems sign transfers of the attacker’s choosing. That matters because a valid blockchain signature can authorize a transfer even when the underlying business instruction is fraudulent. The blockchain record can show that authorization occurred without establishing that the exchange’s normal human and software controls worked.
A separate Elliptic analysis reached a similar conclusion, estimating losses at $6.43 billion across 11 blockchains. It said ordinary signed transfers on multiple networks suggested access to signing infrastructure, rather than a failure of the cryptography itself. The different totals reflect separate investigations and should not be treated as a single finalized loss accounting.
Freezing assets is different from recovering them
Elliptic reported verifying $2.84 billion in frozen assets, while Binance put the frozen amount at approximately $3 billion. The figures were published at different stages of a fast-moving response. Neither means the funds had already been returned to Binance or made available for customer withdrawals.
Elliptic’s tracing also explains why recovery is uneven. Some token issuers can restrict transfers involving their assets, while native assets such as bitcoin and ether have no single issuer with equivalent freezing authority. Investigators observed movements into assets that could not be frozen directly. Visible transaction trails can assist tracing, but visibility and control are different capabilities.
Connected platforms move to contain exposure
The response extended beyond the exchange. In a governance report, risk service provider LlamaRisk said it joined Aave Labs and other providers in an emergency response after an attacker-linked wallet deposited stolen stablecoins and borrowed against them. It reported coordinated freezes across Aave lending markets to prevent additional supply and borrowing.
The report distinguished that action from a full shutdown: repayments, withdrawals and liquidations remained available. It also said the identified attacker position was overcollateralized and did not put Aave suppliers at risk at that point. Those are the response team’s assessments of a specific position, rather than evidence that every platform connected to the stolen funds is free of exposure.
Exchanges confront an operational trust problem
Reuters reported that Coinbase made precautionary adjustments to offline key-storage systems and Kraken was reviewing lessons from industry incidents. Executives also called for faster sharing of information and coordinated detection. Those reactions show concern across the sector, but do not establish that either rival suffered the same breach.
Independent scrutiny also complicates Binance’s distinction between its own hot wallet and customer money. CoinDesk reported that compromised wallets had appeared in reserve data listing assets backing customer balances. Binance’s pledge to absorb the loss addresses who ultimately pays; it does not by itself explain the custody arrangements or prove that every liability is fully covered.
The technical findings remain preliminary. TRM attributes the attack to North Korea-linked TraderTraitor with high confidence, while Elliptic says North Korea-linked involvement is likely. These are private investigators’ attribution judgments. The public record reviewed for this article does not include a completed government attribution or a final Binance technical post-mortem.
The next tests are verifiable
The immediate milestones are restoration of withdrawals, publication of updated reserves and a technical account explaining how unauthorized instructions passed through transaction controls. Binance says it is strengthening the affected infrastructure and will release further findings once verified. A planned reopening is a target, not proof that the remediation has succeeded.
The evidence so far establishes a large theft and a response involving replacement assets, issuer freezes and restrictions at connected lending markets. It does not yet establish the complete intrusion sequence, the amount that will ultimately be recovered or the durability of the repaired controls. Those distinctions will determine whether the exchange’s assurances become demonstrable outcomes.
