The FBI later attributed the theft to North Korea’s TraderTraitor activity and said the stolen assets were being converted primarily into ether.
Binance’s initial investigation pointed to a compromised engineer’s laptop, which may have allowed attackers to reach a service container and submit unauthorized withdrawals. The exchange later said investigators had identified additional points of breach and had found no evidence that wallet private keys were leaked. Binance characterized the incident as a complex attack rather than a single action using one employee’s permissions, leaving the full attack sequence under investigation.
The centralized structure that concentrated billions of dollars in exchange-controlled wallets also enabled emergency intervention. Binance said about $3 billion had been frozen on-chain, while stablecoin issuers used administrative controls to block transfers involving affected USDT and USDC. The freezes prevent movement of those assets but do not by themselves return them to victims. Native bitcoin and ether do not have equivalent issuer-controlled freeze mechanisms, so assets converted into those cryptocurrencies can be traced but cannot be immobilized directly by an issuer.
Binance said it would absorb the losses through its Secure Asset Fund for Users, futures insurance resources and corporate funds. Withdrawals were suspended during security reviews and began resuming in phases on Nov. 1, with deposits remaining open. The exchange also published a proof-of-reserves snapshot and said it would issue a technical post-incident report. The episode leaves a divided security picture: centralized custody created a concentrated route to a record theft, while centralized issuers, exchange reserves and intervention controls limited losses that permissionless systems could not automatically freeze.