Image credit: WIRED

The value of the stolen assets are at approximately $6.36 billion when transferred, about four times the Bybit loss. Ethereum accounted for roughly $3.79 billion, Bitcoin for $1.47 billion, and Tron for $628 million. So far several sources attribute the attack to North Korea’s TraderTraitor group with high confidence, with no published law-enforcement finding on this incident yes. Binance says it is working with investigators to identify those responsible.

The Withdrawal Controls Were the Target

Binance’s initial investigation points to a compromised engineer’s laptop that enabled unauthorized withdrawals. The company says it has found no evidence of a wallet private-key leak and will publish a technical post-mortem once the facts are verified. Cross-chain evidence suggests access to the systems that authorize wallet transfers. These accounts are not necessarily contradictory: an attacker can misuse signing systems without extracting the underlying keys. The entry point, scope of access, and failed controls still require confirmation.

Frozen Does Not Mean Recovered

Binance’s approximately $3 billion freeze estimate is a containment figure, but it does not mean that those assets have returned to the exchange or become available for customer withdrawals yet. Stablecoin issuers such as Tether, Circle and Ripple block transfers of the hacker tokens in a matter of minutes. The attacker raced that process by exchanging stablecoins for ETH and borrowing ETH against USDT on Aave v3. The timing of intervention was important, since native ETH and BTC have no token issuer that can impose an equivalent blacklist. Here is the timeline of the events:

Source: https://binance.lamps.works

Both assets weakened before the late-Thursday breach, then fell sharply near the end of the chart window. The hack coincided with an additional sell-off, but it does not explain every move in the weekly table.

The Next Test Is Operational

Binance pledges to cover all losses using its SAFU protection fund and company funds, and to publish updated proof of reserves after remediation. Those are just commitments so far. We can expect reimbursements will take a while. Withdrawals remain the immediate operational test. Binance’s initial statement announced a deposit and withdrawal suspension, while subsequent reporting said deposits were operating and withdrawals remained restricted. The key distinction is between assets traced, assets frozen, and assets actually restored. Binance’s next meaningful milestones are functioning withdrawals, verified replenishment, and a credible explanation of the breach. 

Sentora systems and vaults had no exposure to the exploit. Liquidity impact was minor and indirect.