Binance Reserves $6.34B to Cover Hack Losses as Withdrawals Stay Suspended

The $6.34 billion reserve figure and TRM's $6.36 billion outflow estimate are close but not identical. The two numbers measure different things: Binance's figure is a company commitment to cover shortfalls, while TRM's is a gross on-chain tally priced at transfer-time values. Neither source has reconciled the two, and Binance has not independently confirmed TRM's total.

Preliminary Cause and Attribution

In preliminary findings, Binance identified a compromised DevOps engineer's laptop as a possible entry point, saying the attacker may have reached an internal service container and submitted unauthorized withdrawal transactions. The exchange said it found no evidence that wallet private keys leaked and has revoked the affected address authorization. Binance has promised a detailed technical postmortem once its investigation establishes the facts.

TRM Labs attributed the operation to North Korea's TraderTraitor group with high confidence, citing on-chain and off-chain intelligence. Binance has not identified the attacker. Blockaid's investigators had earlier examined the Ethereum authorizations used to seize control of the affected wallets, and that work is part of the same public record on the North Korea attribution. The attribution rests on private intelligence rather than a public law enforcement finding.

Customer Status and Next Steps

Binance says deposits are operating normally, while withdrawals remain suspended during security checks and changes to the withdrawal service. An official service update gave an expected resumption window of 48 hours. The exchange also said it is working with authorities and industry partners to retrieve affected funds, and that customer holdings will ultimately be publicly verified through its proof-of-reserves reporting.

In a separate update, The Defiant reported that Binance's $6.34 billion reserve includes $5 billion already held in the affected tokens, and that withdrawals remain paused while the exchange overhauls its security. That reporting is consistent with Binance's own breakdown, and the exchange has not yet published a timeline for completing the remaining purchases.

Strategy Executive Chairman Michael Saylor, in an October 30 X post, wrote that Binance "has committed its own balance sheet to making customers whole. I expect it to deliver." His statement endorsed the response but did not announce any financial contribution from Strategy or disclose its exposure to Binance.

Why It Matters

For Traders

Withdrawals are suspended and the reserve purchases could take longer for illiquid tokens, so exposure to affected assets should be monitored against Binance's next recovery update.

For Investors

A single exchange hack of this scale raises the stakes on custody controls and proof-of-reserves credibility, which could shape counterparty risk assessments across the sector for months.

For Builders

The reported entry point through a compromised DevOps laptop and internal service container shows that operational access controls can matter as much as key management for exchange infrastructure.