Binance hack: frozen funds and actual returns

What is confirmed

After the Binance theft on 29 October, investigators are tracking billions of dollars in stolen cryptoassets. Some assets have been blocked, but the frozen balance cannot be treated as money already returned to the exchange or its customers. The reviewed announcements do not establish an aggregate amount actually returned.

Stolen and frozen amounts

Binance estimates the incident’s impact at approximately $6.3 billion and reports around $3 billion frozen, according to Elliptic’s report. The exchange says it will cover losses using its SAFU fund and company funds. That commitment is a company statement, not confirmation that payments have been completed.

Independent estimates differ. TRM Labs counted $6.36 billion stolen and roughly $2.7 billion frozen as of 00:30 UTC on 30 October. Elliptic puts the theft at $6.43 billion and verifies $2.84 billion frozen; its freeze chart identifies an approximately 12:55 UTC snapshot. These are overlapping measurements of the same incident, not separate recovery amounts that can be added together.

Assets removed from the attacker’s control

Arbitrum’s Security Council provides a concrete example. Its announcement says 8 425 ETH and 74 559 805.2 ARB were frozen and transferred to a designated address. Moving those assets again requires an ArbitrumDAO governance vote coordinated with the relevant parties.

The attacker can no longer spend those funds. However, the announcement does not say they have been delivered to Binance or credited to affected customers. Calling the intervention completed customer restitution would go beyond the evidence.

What investigators have found

TRM attributes the attack to North Korea’s TraderTraitor group with high confidence. Its assessment is that an attacker gained the ability to make Binance’s hot-wallet signing infrastructure authorize transfers across chains. This remains TRM’s assessment, rather than the exchange’s final technical report.

Elliptic also considers North Korean involvement likely. Some stolen funds were combined with proceeds from the Bitget exploit. The firm cautions that a shared laundering network does not, by itself, prove the same hackers conducted both attacks. Its 19:30 UTC update notes that law enforcement had not confirmed attribution.

How much has actually been returned?

The reviewed statements provide no confirmed aggregate for assets returned to Binance or payments completed to customers. The accurate status is therefore unestablished, rather than zero returned.

Further updates need to distinguish three outcomes: assets being blocked, assets reaching their lawful recipient, and obligations to customers being fulfilled. Evidence of completed transfers and payments is needed before a frozen balance can be described as losses actually reimbursed.