Key Highlights:
- Blockchain intelligence firm TRM Labs identified billions in stolen crypto from Binance, attributing the massive cyberattack to the North Korean-linked group TraderTraitor.
- Binance is resuming customer withdrawals in phased stages contingent on individual network security checks, while confirming that 95% of impacted assets have already been replaced using internal reserves.
- The exchange affirmed that all major user balances—including Bitcoin, Ethereum, and stablecoins—are 100% backed and verifiable through its public proof of reserves snapshot.
TraderTraitor Linked to Multi-Billion Dollar Exploit
In a major security incident impacting the global cryptocurrency landscape, blockchain analytics firm TRM Labs reported that attackers drained 18,270 BTC—valued at approximately $1.47 billion—from leading digital asset exchange Binance. In addition to the Bitcoin losses, on-chain intelligence tracked 200,630 ETH, 1.875 billion USDT, and 823 million USDC stolen directly on the Ethereum network. The perpetrators also siphoned 233.46 million XRP, 970,500 SOL, and additional tranches of the dollar-pegged stablecoin USDT across several other public blockchains.
Specialist blockchain tracking firms have officially linked the multi-token exploit to TraderTraitor, a known state-sponsored threat group associated with North Korea. The attack targeted multiple chains simultaneously, liquidating or transferring large portions of both primary cryptocurrencies and fiat-pegged stablecoins like USDT and USDC.
Phased Withdrawals and Emergency Reserve Activation
In response to the exploit, Binance has initiated a phased approach to reopening client withdrawals, emphasizing that access restoration will be tied directly to comprehensive protocol verifications. The platform explained that withdrawal velocity relies on each independent blockchain successfully passing rigorous security and operational stability evaluations before services go live.
Resuming withdrawals is a major milestone, but our work continues. We will continue strengthening our safeguards, completing the recovery process, and providing updates as progress continues,
a Binance spokesperson said regarding the platform’s incident mitigation roadmap.
‘Hard to Be Bearish Here’: Trader Who Predicted 700% XRP Surge Analyzes Current Setup
Customer Funds Restored via SAFU Reserves
Addressing mounting user concerns over asset solvency, Binance confirmed that customer holdings remain secure. To insulate traders and depositors from losses, the exchange has utilized corporate capital—including its Secure Asset Fund for Users (SAFU), a dedicated emergency insurance reserve designed specifically to cover operational security failures—to substitute approximately 95% of the compromised funds, progressing from the 90% reimbursement mark reported the preceding day.
The exchange clarified that its underlying liquidity remains intact, encouraging account holders to review verified protocol data directly. According to the company’s spokesperson: All $BTC, $ETH, $USDT, $BNB, $SOL, $USDC, $XRP, USD1, RLUSD, and ZEC balances are fully backed 100%. Users can verify our proof of reserves snapshot on the PoR website,
confirming that customer deposits maintain full collateralization despite the high-profile breach.
Why This Matters
The attribution of the Binance intrusion to TraderTraitor underscores the ongoing cybersecurity threats posed by sophisticated, nation-state actors targeting centralized digital finance infrastructure. Historically, proceeds from North Korean cyber operations have drawn heightened regulatory scrutiny worldwide due to sanctions-evasion and illicit financing risks. Furthermore, Binance’s rapid deployment of internal capital reserves and SAFU funds illustrates how tier-one centralized exchanges leverage balance-sheet insurance to mitigate systemic panic, reinforcing proof-of-reserves protocols as a primary mechanism to avert liquidity crises in the wake of multi-billion dollar compromises.
Frequently Asked Questions
Which cryptocurrencies were taken during the Binance attack?
According to TRM Labs, the theft included 18,270 BTC (worth roughly $1.47 billion), 200,630 ETH, 1.875 billion USDT, and 823 million USDC on Ethereum, alongside 233.46 million XRP, 970,500 SOL, and additional USDT taken from other network layers.
Who carried out the exploit on Binance?
Blockchain analytics organizations have attributed the cyberattack to TraderTraitor, an adversarial hacking group tied to North Korea.
Are user balances safe following the breach?
Yes. Binance confirmed user assets are secure, noting that 95% of affected holdings have been replaced via internal corporate capital and the exchange’s SAFU reserve. Binance confirmed that impacted assets maintain full 100% backing, which users can track through its proof of reserves snapshot.
