According to Binance's statement on October 30, following the security breach that occurred on October 29, the company temporarily stopped deposits and withdrawals. Binance stated that it will cover all losses from its own resources and user security fund.
While Binance announced the estimated total cost of the incident as $6.3 billion, US-based blockchain analysis company TRM Labs calculated the value of unauthorized transfers made by attackers in 10 different cryptocurrency networks as $6.36 billion. While efforts to recover frozen assets continue, the final loss amount has not yet been announced.
According to research by TRM Labs, the majority of transfers across different networks, including bitcoin and ethereum, were completed in about 20 minutes. $3.79 billion in digital assets were transferred from the Ethereum network, $1.47 billion from the Bitcoin network, and $628 million from the Tron network.
AN EMPLOYEE'S COMPUTER MAY BE AT THE CENTER OF THE ATTACK
In Binance's initial investigations, it was evaluated that the attack may have started by seizing the computer of an engineer responsible for the company's software infrastructure, and that the attackers accessed the company systems in this way and made unauthorized withdrawals.
While cryptocurrency exchanges use "hot wallets" connected to the internet to perform transactions quickly, the transfer of assets in these wallets is carried out through the company's authorization systems.
While Binance announced that there was no evidence of leakage of confidential information called "private key" that provides control of the wallets, TRM Labs stated that the attackers may have benefited from pre-prepared digital authorizations.
While it is not yet clear how the attackers gained access to the systems, Binance stated that it will explain the technical reasons for the security breach in a detailed report.
APPROXIMATELY 3 BILLION DOLLARS OF ASSETS WERE FROZEN
While Binance increased the amount of frozen assets, which it announced as 2.54 billion dollars in the first stage, to approximately 3 billion dollars, companies that issue dollar-linked cryptocurrencies such as USDT and USDC also took action to block transactions at addresses linked to the attack.
Tether, the issuer of USDT, and Circle, which issues USDC, can stop the transfer of digital assets to suspicious addresses. While efforts are ongoing to recover frozen assets, there is no similar mechanism for cryptocurrencies that do not have a central issuer, such as bitcoin.
While TRM Labs announced the total value of 18 thousand 270 bitcoins and more than 420 thousand ethereum under the control of the attackers as approximately 2.4 billion dollars, Binance announced that it would cover the losses resulting from the security breach with its own resources and the "SAFU" fund it created in 2018.
While the prices of bitcoin and other cryptocurrencies decreased following the news of the attack, Binance TR reported that user assets in Türkiye were safe and services continued uninterrupted.
"CENTRAL EXCHANGES ARE ONE OF THE MAIN TARGET OF ATTACKERS"
In his evaluation to the AA correspondent, Aleksandr Nam, Head of the Decentralized Finance and Digital Financial Assets Research Center of the Russian Higher School of Economics, stated that major exchanges keep the assets of millions of users together and said, "The attack on Binance itself should not be surprising. The number and size of attacks against the cryptocurrency sector increased sharply in the 2025-2026 period. More than $ 1 billion in assets were stolen as a result of seizing systems and exploiting security vulnerabilities in the first half of 2026 alone." he said.
Stating that attacks are not always caused by the breaking of blockchain technology, Nam said, "Securities mostly occur in operational and information technology infrastructure." he said.
Nam stated that the main risks include hacking of employees' accounts or devices, social engineering, phishing, access to wallet management systems and deficiencies in authorization controls.
Emphasizing that hot wallets in particular should be protected, Nam said, "For large platforms, it is critical to divide the infrastructure into sections, approve critical transactions by more than one party, apply limits, monitor unusual movements, store most of the reserves offline, and constantly test incident response scenarios." made his assessment.
Regarding the impact of the attack on the markets, Nam said, "This is a serious blow not only to Binance's reputation, but also to the trust in all centralized cryptocurrency exchanges and the industry in general. Investors are again seeing that the concentration of large amounts of liquidity in a single point creates systemic risk." he said.
Stating that decentralized finance platforms also face similar risks, Nam stated that in April 2026, approximately 285 million dollars of digital assets were stolen from Drift Protocol and 292 million dollars of digital assets were stolen from KelpDAO.
Stating that large cryptocurrency exchanges may face more comprehensive inspections as their weight in the financial system increases, Nam said, "The reaction of regulatory institutions will probably be to strengthen the requirements regarding cyber resilience, storage of customer funds, segregation of assets, reserves, independent audit, management of access rights and disclosure of security events." he said.
Regarding the freezing of digital assets related to the attack, Nam said, "Freezing the assets related to the attack is a mandatory but correct measure. This buys time to stop unauthorized asset withdrawals and increases the possibility of users' money being recovered." he said.
Stating that stable value cryptocurrencies are based on reserves in the traditional financial system and that issuing companies should have mechanisms to block addresses within the scope of combating money laundering and complying with sanctions, Nam said:
"The cryptocurrency world has not been completely decentralized for a long time. The paradox here is our old misconceptions that cryptocurrencies are a space completely independent of the control of governments and corporations. The network itself may be decentralized, but a token, bridge, wallet, interface or stablecoin is almost always under the control of a specific person or organization."
ALLEGATIONS REGARDING THE NORTH KOREA CONNECTION ARE ON THE AGENDA
In its research published on October 29, TRM Labs associated the attack with the "TraderTraitor" group linked to North Korea, and stated that the methods used were similar to past attacks attributed to this group. The identity of the attackers has not yet been confirmed by official authorities.
The US Federal Bureau of Investigation (FBI) held North Korea responsible for the theft of approximately $1.5 billion worth of digital assets from the Bybit exchange in February 2025 and attributed the attack to the same group.
Binance announced that it will share the report containing the technical details of the attack and current reserve information after investigations.
