Binance completes latest proof of reserves as it works to restore assets, withdrawals after record hack

On October 30, at approximately 4:20am Singapore time, a massive theft occurred on the world's largest cryptocurrency exchange, Binance. Blockchain analytics firm Chainalysis has reconstructed the attack, revealing that the exchange lost around US$6.4 billion across multiple blockchains, slightly exceeding Binance's own estimate of US$6.3 billion.

The theft is attributed to North Korean state-backed hacking group TraderTraitor, which has targeted exchanges, DeFi protocols, and investors to fund the regime. The report reveals the rapid pace of the attack, with the theft happening within a 54-minute window. The attacker used a compromised laptop belonging to a single DevOps engineer to gain access to Binance's hot wallets, which are internet-connected wallets used for processing everyday withdrawals.

Once inside, the attacker moved the stolen funds to addresses they controlled, with billions of dollars held in Bitcoin and Ether, which cannot be frozen, and billions more in stablecoins like USDT and USDC, which can be blacklisted by their issuers. Within 20 minutes, about US$325 million in stablecoins were converted into ETH, and over the next 10 minutes, the remaining US$175 million was moved to stopover wallets.

Binance began freezing the stolen assets at 5:14pm Eastern Time, about 54 minutes after the first outflows. So far, about US$2.8 billion has been frozen, with Binance reporting a frozen total of US$3 billion, with Tether and Circle accounting for about US$2.4 billion. The attackers still control roughly US$2.4 billion in assets that cannot be frozen.

The rescue relied on centralization, as stablecoins could be frozen because a company behind each one can switch individual tokens off. However, the power to freeze sits with a handful of issuers, mostly outside the region, which is a dependency that raises concerns about stablecoin sovereignty in Southeast Asia. Chainalysis also notes that much of the freezing happened independently, with organizations acting in parallel, working as improvisation rather than a system, which may slow the response in the future.