Binance Says October Breach Affected $6.34 Billion in Crypto Assets

Binance said its Oct. 29 breach affected about $6.34 billion in digital assets, while its Nov. 3 incident report detailed frozen funds, asset replenishment and the exchange’s preliminary account of the intrusion.

Binance said the affected-assets estimate could change as it reconciles the total and token prices shift. It put frozen or intercepted funds at about $2.85 billion as of its Nov. 3 update. Separately, the exchange said it had replenished 98% of affected token assets by Oct. 31, with the less-liquid remainder still being purchased. Replenishment measures assets Binance replaced; it is separate from funds frozen or intercepted.

“Binance will absorb the financial impact of the stolen funds, not our users,” the exchange said.

In its preliminary technical account, Binance said attackers gained unauthorized access to an internal wallet-signing service and initiated transfers outside the normal withdrawal process. The report describes an Ethereum EIP-7702 authorization that gave an attacker-controlled contract partial execution rights through a hot wallet.

Five hot wallets sent 233.46 million XRP tokens between 4:05 and 4:09 p.m. ET (20:05–20:09 UTC) on Oct. 29. Binance’s timeline ends with a transfer of 2,961.9 Ether (ETH) at 7:56 p.m. ET (23:56 UTC).

The FBI attributed the theft to North Korea and referred to the activity as “TraderTraitor.” Binance said its investigation was ongoing and its findings would be subject to further independent review.