Initial investigations pointed to a compromised laptop belonging to a DevOps engineer. That device reportedly gave the intruders access to the services that sign wallet transactions.
Later analysis painted a bigger picture. The intrusion was not a one-off slip but a multi-month campaign. It reportedly combined social engineering, malware infiltration, and misuse of Binance’s own internal AI tools.
The FBI has attributed the attack to TraderTraitor, a North Korean group linked to prior attacks by the Lazarus group.
How Binance is responding
Binance co-CEOs Richard Teng and Yi He have committed to covering all losses from corporate funds. The exchange has set aside more than $6.34 billion for recovery, a pool that includes money from its SAFU reserves, the emergency fund it keeps for exactly this kind of scenario.
The plan also calls for replenishing 98% of affected assets. Binance has said it will publish Proof of Reserves, an accounting exercise meant to show that the exchange holds enough assets to back customer balances.
Approximately $2.85–3 billion in assets has been frozen or intercepted. Stablecoin issuers Tether and Circle cooperated in those efforts.
Withdrawals started coming back in phases on November 1, 2026. Binance tied the restart to a rebuild of its security setup and independent reviews.
Why the shareholder is pushing
Covering losses and explaining them are two different things. Binance has put money on the table, but the shareholder’s call is about accountability and disclosure, not just reimbursement.
A company can write a large check and still leave unanswered how a single laptop ended up holding the keys to billions. Investors and customers want to know whether the weaknesses that allowed a months-long campaign have actually been closed.
What this means for users, investors and the industry
For Binance customers, the immediate risk looks contained, at least on paper. The exchange has pledged full coverage, a large chunk of funds is frozen, and withdrawals have resumed. The real test will be whether the Proof of Reserves report holds up to scrutiny once it is published.
For shareholders, a reserve commitment of more than $6.34 billion is a substantial hit, even for a company of Binance’s scale. Investors will want clarity on how that spending affects the business, and whether the SAFU fund will be rebuilt.
The key items to watch from here are the published Proof of Reserves, any detailed post-incident report from Binance, and further progress in recovering the funds still outstanding.
Leave a Reply