Statements

My money is on an inside job.

Binance’s investigation into its $6.3 billion hack has uncovered “additional points of breach,” the exchange said , after initially pointing to a potentially compromised laptop. The exchange said it was still gathering facts in coordination with law enforcement. Binance said it remained on track to resume withdrawals in 45 hours, while deposits remained unaffected.

08:00 | Verified frozen total reaches $2.84B, 44% of the theft.

TraderTraitor emerged from Lazarus, a group working from North Korea’s Reconnaissance General Bureau, a military intelligence agency.

In the US, Commodity Futures Trading Commission (CFTC) chairman Michael Selig told reporters that “we have the ability to trace all this in the blockchain”. Speaking to CNBC, Selig said it was “very concerning” that there had been “several cyber incidents involving crypto” and the CFTC has regulations in place to prevent this sort of attack.

Binance has pledged to meet customer losses through its SAFU reserve and company resources, announcing more than $6.34bn of company funds separate from roughly $3bn of frozen assets.

Experts, such as TRM Labs, quickly attributed the extraordinary $6.3bn Binance cryptocurrency theft to TraderTraitor, an elite North Korean hacking unit that has also been known as the Lazarus Group.

Binance has said the attack began with a compromised employee laptop and involved multiple breach points. It found no evidence of private-key leakage and said roughly $3bn of affected assets had been frozen.

Cryptocurrency-related firms Coinbase, Strategy, and Robinhood fell in the wake of reports that hackers stole $6.3bn from Binance, the world’s biggest cryptocurrency exchange.

“Our investigation has not attributed responsibility to any individual,” he wrote.

Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.

Early indicators on the Ethereum activity suggested the attacker had phished the authorizations. That explanation covers Ethereum and leaves the other chains unexplained.

North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.

Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.

Binance co-CEO Yi He said Ripple helped stop about USD 200 million from moving; TRM has confirmed the 40.5 million RLUSD freeze onchain.

Binance said it was investigating a potential security issue, then said it had temporarily suspended withdrawals on multiple networks as a precaution. Binance has said user funds are safe.

It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach.

TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. We base this assessment on robust on and off-chain intelligence sources.

In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.

Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion.

TRM traced every transfer from Binance-attributed wallets to attacker-controlled addresses across ten blockchains. Valuing each transfer at the price of the asset at the moment it was taken, the total is approximately USD 6.36 billion. At current prices, the same assets are worth about USD 6.23 billion.

On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC.

Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.

i do however agree binance has a high probability of not being an exit scam BECAUSE if 6b was their hot wallet you cant possibly imagine how much is in the cold wallet