Binance’s Coverage for Hack Losses Reaches 90% of $6.3 Billion in Assets
Key Facts
Binance said coverage set aside for losses from the hack of its hot wallets had reached 90% of affected assets, up from about 80% in its previous update. The platform said on Oct. 31 that it had allocated more than $6.34 billion in company funds to cover the losses. It had said its hot wallets were hacked at around 20:05 UTC on Oct. 29, with the estimated impact at about $6.3 billion in digital assets. TRM Labs estimated that the attacker moved about $6.36 billion from Binance wallets across 10 blockchain networks. Most transfers took place over about 20 minutes starting around the time of the hack, according to TRM, while the figures reflect different estimates of the value of affected assets and transfers.
Binance said company funds allocated for coverage exceeded $6.34 billion, and that the share of affected assets that had been replenished rose to 90% in its Oct. 31 update from about 80% in the previous update. It said the 80% figure was from its previous update, while 90% represented the latest coverage level. The Associated Press estimated that the company had enough of the same cryptocurrencies that were stolen to cover 90% of the lost assets, and reported its pledge to fully compensate customers. In a separate analysis, Elliptic estimated the theft at about $6.43 billion, compared with the $1.46 billion Bybit theft in 2025. Elliptic said the incident was therefore more than four times larger than the biggest comparison it cited, while Binance’s estimate of the impact remains about $6.3 billion.
Binance’s initial account pointed to the possible involvement of an engineer’s compromised laptop in development and operations, which enabled the attacker to access a service container and send unauthorized withdrawal transactions. The company said it had found no evidence that wallet private keys had been leaked. But in a later update, it said the investigation had uncovered additional points of compromise and that work to establish the full sequence of the attack was ongoing. TRM estimated that preparations began at least 36 hours before the theft. It added that the operator’s wallet received three small withdrawals from the Tornado Cash service starting on the morning of Oct. 28.
On the Tron network, TRM detected flows of 612.7 million USDT and 46.4 million TRX, worth a total of about $628 million. Elliptic said the attacker exchanged 234 million USDT for 638 million TRX through the SunSwap service before token sales halted at around 06:36 UTC on Oct. 30. Since early that day, Tron’s main token distribution wallet had sent assets in 546 transfers, with a median interval of 96 seconds between transfers, the company said. Transfer activity accelerated overnight to between $3 million and $7 million an hour, according to its analysis.
Elliptic said it had verified on the blockchain the freezing or seizure of $2.85 billion, equal to 44% of the estimated value of the theft, most of it in USDT and USDC. The Federal Bureau of Investigation attributed the attack to malicious cyber activity by the North Korea-linked TraderTraitor group, according to the Associated Press, and requested that transactions linked to specific addresses be blocked. Elliptic had said the group was likely behind the theft, while noting that no government or law enforcement agency had confirmed the attribution at that time. The bureau traced the stolen assets as having been moved mainly into Ethereum and said it expected an attempt to move them through decentralized finance and instant-swap services. A TRM expert told the agency that money laundering could continue for months if the assets were split up and sent through smaller platforms.
EL7 data showed Tron closing at $0.3298 on Oct. 28, then $0.3524 on Oct. 29 and $0.3272 on Oct. 30, before falling to $0.3065 on Oct. 31. In the broader cryptocurrency market, Bitcoin fell 3.2% on the evening of Oct. 29 to below $79,000 after news of the incident emerged, the Associated Press said. Binance is still targeting a resumption of withdrawals on Sunday, Nov. 1, within the timeframe it previously announced. It said it would issue another update once details were confirmed, without specifying a time for the resumption or stages for restoring service. In its third update, the company said it was focused on the withdrawal resumption date, while it had said in its Oct. 30 update that it expected to share technical findings after they were verified.