Six billion dollars is a number you usually see attached to a company buyout. This time, it is attached to money stolen from a crypto exchange.
Binance has put the impact of its October 29 security breach at around $6.3 billion. The scale is staggering, but there is another part to this story: some of those assets have been stopped before the attackers could move them further.
What happened at Binance?
In its security update, Binance said an initial investigation pointed to a compromised engineer’s laptop. That may have given an attacker access to a service used to submit unauthorised withdrawals. The exchange said it had found no evidence that wallet private keys had leaked.
That is an early explanation, not the finished investigation. Binance subsequently said it had found additional points of breach, according to AP’s updated report.
So the tempting version, that one laptop explains everything, is already looking too simple. The full technical account still matters.
Why are investigators pointing to North Korea?
Reuters reports that blockchain analysis firms TRM Labs and Chainalysis have attributed the attack to North Korea with high confidence. Elliptic also suspects North Korean involvement.
Those are investigators’ assessments. Binance said its own investigation had not attributed responsibility to any individual. North Korea, which routinely denies involvement in cyber theft, had not responded to Reuters’ requests for comment.
Reuters says the bulk of the theft happened in roughly 20 minutes. Think about that for a second. Billions moving while most of us would still be deciding what to watch over dinner.
Frozen money is not the same as money returned
Binance says partners have frozen roughly $3 billion in affected assets. Its initial statement also promised to cover losses using its emergency SAFU fund and company money.
There is an important difference here. Blocking assets from moving does not automatically mean they have been returned to the exchange or credited back to customers. Freezing, recovering and covering losses are separate parts of the response.
Reuters later reported that Binance had set aside about $6.34 billion internally to cover the losses. That is the company’s commitment, rather than proof that the entire recovery process is finished.
What happens next?
Withdrawals were still suspended in the October 30 updates reviewed for this article. Binance expected them to resume within a day or two, according to AP. That was an expectation, not a confirmed reopening.
The next things to watch are actual withdrawal access, how much money is recovered and a clear explanation of how the attackers got through.
A promise to cover the bill matters. Explaining how a bill this large became possible matters just as much.
