Binance expects to begin resuming withdrawals within 48 hours as its security team revamps withdrawal services and address controls following an estimated $6.3 billion hack. Co-founder Yi He said deposits and related services are operating normally after an earlier temporary pause, while engineers trace the full attack path through a compromised DevOps laptop that gave access to a service container used to submit withdrawal transactions.

A breakdown by blockchain analytics firm Arkham put the theft from Binance hot wallets at $6.01 billion across nine blockchains between 20:10 and 23:05 UTC on Oct 29, with $4.9 billion drained in the first 15 minutes. Arkham traced $3.74 billion in outflows on Ethereum, $1.47 billion on Bitcoin, $628.09 million on Tron, $95.9 million on Solana and $77.7 million across Arbitrum, Avalanche, Polygon, Optimism and Base. Issuers have frozen $2.8 billion of that total, while $911 million in USDT and altcoins was swapped into ETH and TRX and $2.9 billion remains movable, including 18,270.2 BTC ($1.41 billion), 495,724 ETH ($1.09 billion), 682.9 million TRX ($242.59 million) and 970,545 SOL ($92.15 million).

Blockchain intelligence firm TRM Labs attributed the heist, the largest in crypto history, to North Korea’s state-sponsored TraderTraitor group and estimated outflows at $6.36 billion across 10 chains. On Ethereum, a Tornado Cash funded relayer submitted 50 pre-signed EIP-7702 authorizations to install a sweeper contract on the Binance 14 wallet and drain its balances alongside 780 million USDC from Hot Wallet 34. Binance said it found no evidence of a private key leak and will cover all unrecovered losses using its SAFU insurance fund and corporate reserves.