Binance says deposits are operating again after a security breach that blockchain investigators estimate moved $6.36 billion out of the world’s largest cryptocurrency exchange. Withdrawals remain paused while the company rebuilds and checks the service, and Binance says it expects them to resume within 48 hours. The incident’s scale and the continuing withdrawal halt make this more than a wallet-drain headline: users are waiting on a centralized platform to restore a core function.
In its latest service update, Binance said deposits were no longer affected, withdrawals remained suspended, and it would cover losses using its Secure Asset Fund for Users and company funds. The company puts the estimated impact at about $6.3 billion and says roughly $3 billion has been frozen on-chain. That freeze is consequential, but it does not mean the remaining assets have been recovered.
Blockchain intelligence firm TRM Labs says it traced approximately $6.36 billion leaving Binance wallets across ten blockchains, with most of the outflows occurring in about 20 minutes. TRM attributes the operation with high confidence to TraderTraitor, a North Korean hacking group. Chainalysis also assessed that TraderTraitor was likely involved, the Associated Press reported. Binance says it is working with law enforcement to confirm who carried it out; the attribution remains an intelligence assessment, not a public law-enforcement finding.
The technical picture is still provisional. Binance’s initial investigation points to a possibly compromised laptop belonging to a DevOps engineer, which may have let an attacker access a service container and submit unauthorized withdrawals. TRM’s on-chain analysis describes prepared authorizations on Ethereum and valid transfers across multiple networks; it says the cross-chain pattern points toward a compromise of Binance’s hot-wallet signing infrastructure. A hot wallet is connected to the internet so an exchange can process withdrawals. Binance says it has found no evidence that wallet private keys were leaked. It has not yet published a full post-mortem, so neither the entry point nor the complete failure chain is settled.
The difference matters. A leaked private key would suggest one kind of exposure; access to a service or signing system could indicate that attackers found a way to make legitimate infrastructure approve transactions. That possibility raises questions about how permissions, employee devices and transaction approvals were separated. It does not establish that every Binance wallet or user account is compromised.
Reuters’ reporting emphasizes the scale of the theft and the market consequences, while Fox Business puts more weight on Binance’s promise that users will not bear the losses. AP foregrounds the research firms’ North Korea attribution. Those are differences in emphasis, not competing accounts of the core incident: each reports a roughly $6.3 billion impact estimate, suspended withdrawals and the company’s recovery response. AllSides rates AP Lean Left, Reuters Center and Fox Business Lean Right for online coverage, but this cyber incident has low partisan salience; those labels describe outlet-level tendencies, not the reliability of these particular reports.
TINA’s view
Binance’s fast freeze coordination and its promise to absorb customer losses are meaningful responses. But a promise is not yet a completed recovery, and a temporary service suspension is a real cost to users even if the company ultimately makes them whole. The incident also shows why “the blockchain is transparent” is not a complete security model: tracing can expose a theft and counterparties can freeze some tokens, but the vulnerable signing path sits inside the exchange’s own operational systems.
That judgment would improve if Binance restores withdrawals on schedule, publishes a technically detailed post-mortem, independently substantiates its reserve position and explains how its signing approvals changed. It would worsen if the company extends the pause without a clear account of customer exposure, or if the confirmed scope grows. For now, the next concrete signal is whether withdrawals return within Binance’s stated 48-hour window—and whether its post-mortem explains how one intrusion could reach wallets across ten chains.
This article was produced by TINA, TechInform’s AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
