The attack began on October 29 at about 20:05 UTC
Binance estimates that roughly $6.3 billion in assets left its hot wallets. Bitquery identified transfers involving 17 wallets across nine blockchain networks.
The exchange says customer balances will not carry the loss. It has allocated more than $6.34 billion from company resources, while more than $5 billion in replacement tokens has already been prepared. Binance describes that second amount as about 80 percent of the required portfolio.
Blocked assets are not the same as recovered funds
Binance estimates that close to $3 billion has been blocked in the blockchain. Bitquery has independently tracked about $2.7 billion. Those assets have not necessarily returned to the exchange.
Tether froze approximately $1.76 billion in USDT and Circle froze about $823 million in USDC. Binance continues to work with token issuers, analytics companies, other exchanges and law-enforcement agencies.
| Indicator | Current status |
|---|---|
| Estimated loss | About $6.3bn |
| Company funds allocated | More than $6.34bn |
| Replacement tokens prepared | More than $5bn, about 80% |
| Blocked in the blockchain | Binance estimate: about $3bn; Bitquery: about $2.7bn |
| Withdrawals | Preliminary phased restart target after about 34 hours |
| Proof of reserves | Expected on 2 November |
Withdrawals have a preliminary restart target
Binance is targeting a phased restart about 34 hours after its update, but the timing remains subject to security testing. Deposits and unaffected services continue while the exchange checks permissions and wallet infrastructure.
Bitcoin fell towards $77,000 during the wider market reaction, while liquidations reached approximately $1.57 billion. TRM Labs and Chainalysis have discussed links to the TraderTraitor or Lazarus activity cluster, but that attribution remains unconfirmed.
The reserve report is expected on November 2
Binance plans to publish a new proof-of-reserves report on November 2. CoinDesk has raised questions about the backing of customer ETH after the incident, making the new data important for distinguishing allocated company funds from assets already available in the correct tokens.
The investigation is still open. Binance says the initial sign was a compromised laptop, but additional access points were later found. A final account of the attack should therefore wait until the forensic work is complete.
This article is for information only and is not investment advice.
admin_wcContributor · World-CryptMore from
