Incident: 29 October 2026 UTC. Reporting cutoff: 4 November 2026 Malaysian time.
Binance's initial findings and response update, dated 3 November, reported approximately US$6.34 billion in affected assets and US$2.85 billion frozen or intercepted. These are preliminary company figures, subject to reconciliation and valuation changes.
Binance said it would absorb the financial impact and that 98% of affected token assets had been replenished as of 31 October. Replenishing customer backing with company funds is different from recovering stolen assets.
Chainalysis's investigation, first published on 30 October and subsequently updated, estimated approximately US$6.4 billion in unauthorised transfers. It attributed the attack to the North Korea-linked TraderTraitor group based on its on-chain analysis.
Chainalysis described valid signed authorisations allowing an Ethereum wallet to run attacker-controlled code, followed by asset transfers and laundering activity. Its attribution is an investigator's assessment; the company's internal compromise account and the on-chain investigation are separate sources of evidence.
The current Chainalysis page records an update at 19:44 UTC on 3 November, corresponding to 3:44 am on 4 November in Malaysia. This archive report is therefore dated 4 November in Malaysian time.
Sources: Binance's company update, 3 November; Chainalysis's investigation, reviewed 4 November 2026.