Binance preliminary report details signing-service intrusion and revises funding figures

Binance’s initial notice said it had not confirmed an impact on user funds. The exchange then edited that notice to state that user funds are safe, and subsequently said withdrawals would resume after the security issue is fully resolved. These are the vendor’s statements, not an independently audited reserve or loss assessment. No resumption time or technical containment report was supplied in those notices. The withdrawal notice does not specify affected networks or withdrawal routes; do not infer that every Binance product is affected. Those earlier notices supported L3 because they acknowledged disruption without confirming the suspected theft.

CZ separately suspects a hack and says he expects users to be covered, while explicitly stating that he no longer manages Binance.com. His earlier expectation was not a formal reimbursement guarantee from current management. Reported stablecoin freezes must not be counted as refunds or added to outflow estimates to calculate a loss. Circulating monetary estimates are unverified here; no independently reconciled stolen-fund total or victim count is established.

The November 3 preliminary report now describes initial access and claims key containment steps are complete; final root cause and independent validation remain pending. We have not independently traced the transactions or authenticated wallet ownership. The cited sources do not establish a link to the separate Polymarket/DebugBear incident, or a Binance root cause of frontend injection or private-key theft. Ordinary account-security measures are useful against account abuse, but cannot establish that exchange custody systems are safe.

Update, October 30: Yi He now explicitly says Binance will cover all hacking losses, confirms that deposits and withdrawals are temporarily suspended, and promises a post-mortem after the investigation. This current-management acknowledgment replaces the earlier uncertainty over whether the exchange itself had acknowledged hacking losses and supports L4. It does not establish a technical root cause or audited net loss.

Binance separately reports a verified frozen amount of around $3 billion. This vendor figure is not an independent reconciliation, and frozen assets must not be treated as returned funds or added to outflow estimates. Aave says it froze all DAO-operated V3/V4 markets as a precaution while its contracts remain unaffected and positions overcollateralized; the available official embed truncates later operational details.

Further update, October 30: Binance now says its initial investigation suggests a compromised DevOps engineer’s laptop may have enabled access to a service container and submission of unauthorized withdrawals. This replaces the earlier absence of a vendor-described attack path, but remains preliminary. The visible notice truncates its private-key statement, so it does not establish here whether wallet keys were exposed. At that stage, loss coverage, deposit/withdrawal suspension and the frozen-asset figure were unchanged. The newer service update below supersedes current deposit status; a full post-mortem and reconciled net loss remain outstanding.

Service update, October 30: Yi He now says deposits remain unaffected and operate normally, superseding the earlier suspension notice for current deposit status. Withdrawals are expected to begin resuming within 48 hours while service and address-control enhancements continue. This forecast does not establish full reopening or completed containment.

Investigation update: Binance now reports additional breach points, so the laptop must not be treated as a confirmed single root cause. TRM attributes the attack with high confidence to North Korea’s TraderTraitor and assesses signing-infrastructure compromise as likely; these are researcher judgments, not final vendor findings. Its roughly $6.36bn measures outflows at transfer-time prices, not net loss; this figure is not independently verified here. TRM’s ~$2.7bn frozen snapshot at 00:30 UTC differs in timing and scope from Binance’s later ~$3bn report; do not add them.

Full-notice update: Binance puts stolen assets at about $6.3bn and says it has not found evidence of wallet-private-key leakage. This supersedes the earlier truncated notice, without ruling out exposure. Its loss figure remains unaudited here and differs from TRM’s outflow estimate. Recovery timing is conditional; the report does not establish completed containment or a final root cause.

Recovery update, October 31: Binance says it has replenished 90% of the previously announced company-funded coverage. This is a vendor claim about replacement funding, not a statement that 90% of stolen assets were recovered. Its new reserve snapshot is dated October 31 at 00:00 UTC; the full zero-knowledge proof is still being generated and is now expected November 3 UTC. Withdrawals remain targeted for November 1, superseding earlier countdown estimates without confirming reopening. Neither this funding update nor a reserve snapshot establishes a final attack root cause.

October 31 attribution update: The FBI now assigns the theft to North Korea’s TraderTraitor. This adds a law-enforcement assessment to TRM’s earlier research finding. It does not resolve Binance’s initial-access investigation or establish a reconciled net loss. The FBI observed conversion mainly into ETH; further DeFi and instant-swap laundering is its expectation.

November 1 recovery update: The new notice specifies a first-phase withdrawal window of 06:00–09:00 UTC. Check the vendor’s asset/network table and live status; other pairs await readiness checks. Binance now reports 95% replacement funding, with the remaining 5% in less-liquid tokens outside its ten fully backed assets. This is company funding, not recovered stolen funds or an independent audit. A post-incident report remains pending.

Further November 1 update: Binance names Bitcoin as the first withdrawal batch and says newly generated wallets, now included in its reserve-address list, will handle future withdrawals. Yi He subsequently describes processing as broadly smooth while allowing for congestion and asks users to check destinations and device security. These statements do not establish that every asset/network pair is available, that the full reserve proof has been published, or that the investigation is complete.

Later November 1 restoration: Binance now explicitly reports withdrawals restored for USDC, USDT and ETH on Ethereum, and USDC, USDT and BNB on BNB Smart Chain. This is stronger than the earlier first-batch announcement for these six pairs only. Continue checking live availability for the exact pair; the post does not establish recovery of every asset or network, a completed investigation, or a published full reserve proof.

Further November 1 restoration updates: The separately read new-asset sections of Binance’s linked posts confirm the checklist’s 33 specific pairs across 15 networks. Their closing or repeated lists truncate in the public copies. These are vendor statements, not independent proof that every withdrawal succeeds or every asset on a network is supported. Check live availability. Neither restoration nor replacement funding proves recovery of stolen funds; the investigation remains unfinished.

November 2 reserve update: Recovery Update #5 supersedes the earlier pending-proof status: Binance says the full zero-knowledge proof for the October 31 00:00 UTC snapshot is generated and the ten listed tokens are verifiable. This reports the vendor’s publication and verification instructions; it is not an independent audit or a claim that we verified a customer account. The approximately 95% replacement funding remains unchanged. Additional networks/assets are planned for November 3 and a broader snapshot for November 4; the latter is expected to require another 40–50 hours of proof generation. These plans do not establish that all withdrawals are already open or that the stolen money has been returned.

November 3 withdrawal update: Recovery Update #6 announces further asset/network pairs from 04:00 UTC across BSC, Ethereum, Solana, XRP, SUI, Arbitrum, Optimism, TRX and Base, plus all BSC bSTOCKS. Its table is a rollout list: each pair awaits security and readiness checks, and the vendor directs users to live availability. Deposits remain open; delays and retries may occur. This advances the earlier plan without establishing complete restoration, recovered stolen funds or a final root cause.

November 3 preliminary investigation: Binance retrospectively says engineer A downloaded a tampered Homebrew installer while seeking an AI coding tool in June. Device replacement and credential rotation followed, but role/team information had already been exposed. In September, engineer B ran a fake recruitment assignment that installed malware on a work device and replaced a development-tool component. This does not establish compromise of the official Homebrew project or an unpatched CVE. On October 20 the attacker pivoted through internal AI tools to other devices and obtained A’s container-deployment token. A malicious container was deployed from C’s device on October 29 at 17:15–19:56 UTC, followed by access to the internal wallet signing service, bypassing ordinary withdrawals.

The report says 50 signed transactions manipulated account nonces and EIP-7702 delegation; malicious on-chain authority persisted after withdrawals were paused. The last pending 2,961.9 ETH transfer finalized on October 29 at 23:56 UTC. Binance says a new authorization operation from its Binance14 hot wallet cleared the delegation on October 30 at 00:10 UTC. These UTC times are converted from the report’s explicit UTC+8 timezone. This is not evidence that MPC was broken, private keys leaked or every ordinary user account was compromised.

Revised amounts and containment: The report now puts assets involved at about $6.34bn and frozen or blocked assets at about $2.85bn, subject to reconciliation and price changes. It retrospectively says 98% of affected token assets had been replenished by October 31 (UTC+8), with illiquid tokens still being purchased. This differs from the roughly 95% in the November 1–2 notices: treat it as a later vendor revision, while preserving the historical timeline. Frozen assets, blocked assets and company-funded replacement are not returned stolen funds or an audited net loss.

Binance claims exploited entry points are closed, systems on the attack path have been rebuilt or replaced, related credentials/tokens revoked and employee devices checked, with stronger wallet, device and anomaly monitoring. Independent security review is still being commissioned and some details remain undisclosed for the investigation. These are preliminary vendor findings, not a completed independent audit, final root cause or complete service restoration. The published pyenv paths require file and behavioural evidence; legitimate installations can contain the same paths.

November 3 laundering research: TRM reports value moving through attacker-created tokens and liquidity pools on TRON, transferable lending receipt tokens, and chained cross-chain swaps whose payout is sent directly to another bridge’s deposit address. These routes can break a USDT-only trace without proving funds vanished. TRM also describes active TRON/Solana movement while major ETH/BTC positions remained parked at its observation time; no current all-funds location is inferred. This is researcher attribution, with some payouts linked by amounts/timing. The report’s differing amounts and snapshot dates are not reconciled here and do not replace Binance’s figures, establish returned funds or prove that an onward service was compromised. Its FAQ’s statement that no government attributed the theft is superseded by the FBI source already retained above.

November 4 research revision: Bitquery expands its TRX-route tracing from an earlier partial THORChain sample to 98 labelled sending wallets and 102 named Ethereum payees, reporting about 19,985 ETH in their onward wallets, including about 4,000 ETH from senders it has not traced. It separately describes Solana proceeds moving via USDC/CCTP to Ethereum or Avalanche and then through THORChain toward Bitcoin after that service reopened. Its total holdings estimate is about $3.1bn, including 556,271 ETH, at 09:56 UTC; selected newly counted Solana/Bitcoin wallets were checked through 11:28 UTC. These unverified research estimates mix attribution, routing and valuation assumptions; they are neither an additional theft nor returned funds, and do not replace Binance’s $6.34bn affected/$2.85bn frozen-or-blocked vendor figures or replacement-funding claims.

The researcher no longer says none of the traced money reached exchange deposit addresses: earlier analysis described TRX flows to HitBTC and a cash desk. The revision replaces the cash-desk label with a shared hub wallet and excludes its payouts from the attacker’s flows. The earlier pass found no mixer transfer in the paths it followed. Its November 7 revision supersedes that finding for Solana. This does not prove those onward services were compromised or identify all proceeds. The newly counted wallets revise coverage, not the original theft size; do not extrapolate one snapshot into a complete current balance or combine unrelated bank/BitMart events.

November 4 reserve expansion: Recovery Update #7 confirms a new 00:00 UTC snapshot for 44 tokens, replacing the earlier plan for a broader snapshot. Its full zero-knowledge proof is still being generated, now estimated at 50–60 hours rather than the earlier 40–50-hour forecast. The completed October 31 ten-token proof remains a separate historical record. Binance repeats 98% company-funded replenishment, with remaining illiquid tokens bought through market and OTC channels. This is neither a new recovery of stolen funds nor confirmation of full withdrawal restoration.

November 4 Polygon governance proposal: The original forum proposal says five transaction-blocked addresses hold about 70.49M native POL associated with two separate incidents: four Polymarket addresses have a reference total of 23,862,736.07 POL and one Binance address 46,626,593.27 POL. It requests a one-time coordinated fork moving the specified balances to verified recovery addresses without changing supply; other tokens and Class B addresses are outside the transfer. Governance approval, balance reconciliation, proof of recovery-address control and an Amoy rehearsal are conditions. The client release, fork name and mainnet activation block are undecided. November 5 at 14:30 UTC is the planned discussion, not an activation promise. Address ownership and blocking are the author’s account, not an independent chain investigation here. This does not establish an approved fork, returned assets or additional customer reimbursement. Do not add the two incident shares to this event’s loss, or double-count them with frozen funds, replacement funding or compensation.

November 5 withdrawal expansion: Recovery Update 8, read through its full public CMS response, announces additional asset/network pairs from 04:00 UTC. The table covers ETH, BSC, Base, TRX, MATIC and SUI; examples are UNI/AAVE/PAXG on ETH, ASTER/PROM/UNI on BSC, AERO/VIRTUAL/MORPHO/AVNT on Base, JST/SUN/BTTC on TRX, GNS on MATIC and MMT on SUI. Consult the complete table for all entries. Each pair opens progressively after checks, not simultaneously; verify live availability and expect possible delays. This advances the restoration plan without establishing full reopening, a completed new reserve proof or additional recovered stolen funds.

November 5 research follow-up: Bitquery reports that a trading bot partially liquidated the attributed Aave position on November 4, repaying 9,884 WETH and taking 24.4M USDT from the pool. This is a lending liquidation, not a transfer of that sum back to Binance or a new issuer freeze: the USDT came from the pool, while the attacker retained previously borrowed ETH. At its November 5 07:37 UTC holdings snapshot, the researcher estimates about $3.2bn still in attributed wallets (previously $3.1bn at the November 4 snapshot), plus a remaining Aave deposit of 35.6M USDT against 9,885 WETH debt. The changed dollar valuation is not a newly established theft amount; the report excludes the deposited USDT from its wallet-holdings total. It also follows further Solana proceeds through CCTP and THORChain into Bitcoin. Amounts, linkage and completeness remain unverified research findings. Preserve the vendor’s separate loss, blocked-assets, replenishment and staged-withdrawal statements; none of these figures establishes recovery of stolen funds or compromise of Aave, a bridge or every user of those services.

November 5 Arbitrum recovery proposal: Binance requests 8,425.997 ETH and 74,559,805.2 ARB held at the frozen address. Its AIP anticipates forum discussion, a Snapshot temperature check, an on-chain vote and final execution over about 49 days, potentially longer if legal restraints apply. Submission/execution are conditional on the stated legal process and indemnification agreements. No new DAO treasury allocation is requested. Returned assets would address incident losses and costs, potentially replenishing SAFU/treasury reserves already used to cover users; they are not necessarily an additional user payment. This is separate from the Polygon native-POL proposal and does not prove approval, released funds or completed compensation.

November 6 withdrawal expansion: Recovery Update 9 schedules additional pairs from 04:00 UTC on BSC, Base, ETH, Optimism, MATIC, Arbitrum, AVAXC, TRX and SUI. Read its complete asset/network table: examples include USDE/PENDLE on BSC, ZRO/BREV on Base, U/XRP on ETH, ETH/WLD on Optimism and FDUSD on SUI. Each pair opens progressively after security/readiness checks; deposits remain open. Confirm the exact pair on the withdrawal page or official network-status page and allow for temporary delays. This is further service restoration, not an assertion that every withdrawal is available, stolen funds have been recovered or the new reserve proof has finished.

SEAL’s November 5 assessment: SEAL estimates roughly eight weeks of access before October 29 and distinguishes TraderTraitor from Contagious Interview despite the shared job-interview lure. Binance has not supplied a precise September entry date or confirmed the report’s four campaign domains as its own intrusion URLs. SEAL’s AFX example can exploit Git CVE-2025-48384; that is not evidence Binance was compromised through that CVE. The analysis also contrasts other incidents involving cloud sessions or backend transaction manipulation, so it does not prove that every case involved stolen signing keys. The estimate and campaign indicators supplement the exchange’s findings; they do not revise stolen, frozen, replenished or repaid totals.

November 5 Global Ledger snapshot, verified November 6: The researcher estimates $5.99B remained at linked addresses at November 4 prices: $2.82B frozen and $3.16B freely held in BTC, ETH and XRP. These rounded, unverified research figures differ in timing and scope from Binance’s approximately $3B freeze statement; do not add or subtract them to calculate final losses. Its $1.28B selected outflow sample covers $996.2M swaps and $176.6M bridges, not all stolen assets; swaps can return proceeds to attacker wallets, so flows are not additional thefts. It counts 132 stablecoin freeze transactions by 12 issuers, not 132 victims or repayments. The snapshot establishes neither returned funds nor completed recovery.

SEAL November 6 revision: Session expiration and device binding at issuance remain useful but cannot by themselves protect a persistently compromised endpoint. The expanded guidance prioritizes least standing privilege, distinct service identities, adversarial alert verification and reducing direct human production access. Pipeline-mediated changes concentrate risk in repositories and CI, so those paths need explicit protection. This adds response guidance without changing losses, freezes or recovery claims.

November 7 tracing update. Elliptic estimates that roughly 2,300 BTC ($175 million) converted from other stolen assets sat in new Bitcoin addresses at about 08:00 UTC, up from about 1,650 BTC ($124 million) at 08:45 UTC on November 6. It traces about 44 million additional XRP leaving the linked XRP addresses overnight, mostly into BTC through THORChain, and estimates 88 BTC had gone through Wasabi-style coinjoins in total. Elliptic says the major original BTC and ETH holdings had yet to move and estimates that little had been cashed out. These tracing estimates remain independently unverified. Conversions and mixing describe where portions of the existing proceeds moved. They do not establish additional theft, asset recovery or the identity of the controller of each onward wallet. The exchange’s freeze, replenishment and withdrawal statements remain separate.

November 7 Bitquery correction. Bitquery revised its estimate of frozen or rescued assets from about $2.7bn to $2.8bn, including roughly $75M in wBETH it says Binance blacklisted on the night of the theft. It reports that linked wallets sent about $7.7M in SOL to Privacy Cash on November 3–4, a route missed in its earlier reports. It also attributes 19,762 ETH to borrowing against stolen USDT on Aave rather than purchases. These are unverified estimates and tracing judgments. A freeze, a transfer into a mixer or a lending position is not evidence of a refund, and the $2.8bn estimate must not be added to Binance’s separate ~$2.85bn frozen-or-blocked figure.

In a companion analysis, Bitquery estimates that by November 6 at 10:00 UTC, about $333M had crossed chains, reached mixers or entered exchanges, valued at theft-time prices. That category includes transfers and does not establish conversion to fiat, recovery or additional theft. Do not add it to other tracing estimates.