تحديث اختراق Binance: تخصيص 6.34 مليارات دولار، واتهام كوريا الشمالية، واستهداف يوم الأحد لبدء عمليات السحب

Tradeassi_com · 2026-10-30T16:47:04.000Z

أمس، أشرنا إلى سحب مشتبه به من المحافظ الساخنة لـ Binance، مع تقديرات تراوحت بين 2.5 و5.8 مليارات دولار ومن دون تأكيد. وخلال الساعات الأربع والعشرين الماضية، اتضحت الصورة: تأكد الاختراق، وأصبح حجمه أوضح، وأعلنت Binance من سيتحمل التكلفة، كما سمّى المحققون مشتبهًا به. الحجم: تقدّر TRM Labs قيمة السرقة بنحو 6.36 مليارات دولار، نُقلت من محافظ Binance عبر 10 سلاسل كتل، معظمها خلال نحو 20 دقيقة بدءًا من الساعة 20:05 بالتوقيت العالمي المنسق يوم الخميس. وتقدّر Chainalysis القيمة بنحو 6.4 مليارات دولار. وهذا يجعلها أكبر سرقة للعملات المشفرة مسجلة، إذ تعادل نحو أربعة أضعاف اختراق Bybit الذي بلغت قيمته 1.5 مليار دولار في فبراير 2025.

Yesterday we flagged a suspected drain from Binance hot wallets, with estimates from $2.5B to $5.8B and no confirmation. In the last 24 hours the picture firmed up: the hack is confirmed, the size is clearer, Binance has said who pays, and investigators have named a suspect.
The size:
TRM Labs puts the theft at about $6.36B, moved out of Binance wallets on 10 blockchains, most of it in about 20 minutes from 20:05 UTC Thursday. Chainalysis puts it at about $6.4B.
That makes it the largest crypto theft on record, roughly four times the $1.5B Bybit hack of Feb 2025.
Who (per the analytics firms):
TRM ("high confidence") and Chainalysis both attribute it to TraderTraitor, the North Korean group the FBI blamed for Bybit.
Chainalysis says it saw stolen Binance funds commingling in real time with proceeds of last month's Bitget exploit. North Korea has denied past hacking allegations.
How:
On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper, with 50 pre-signed authorizations prepared in advance (TRM).
On the other nine chains, funds left through ordinary signed transfers, which TRM reads as a compromise of Binance's hot-wallet signing infrastructure.
Binance says its investigation began with a compromised engineer's laptop and has since found "additional points of breach".
Who pays:
Binance says it has reserved more than $6.34B of company funds to cover user losses. About $5B is already held in the exact tokens that were stolen; the rest is being bought via market and OTC, which may take longer for low-liquidity tokens. Frozen assets are not counted in that figure.
Frozen vs still loose:
Tether, Circle, Ripple and World Liberty Financial froze about $2.67B in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6M ARB (TRM). Binance puts the total frozen at about $3B.
The attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4B beyond any issuer's reach.
What to watch next:
Withdrawals are still paused. Co-CEO Richard Teng is targeting a restart by Sunday, within about 40 hours of his Friday remarks, but only if the rebuilt withdrawal service passes testing (The Defiant).
Teng also promised a full Proof of Reserves report by Monday.
Any large sales of the unfrozen ETH and BTC would hit spot liquidity.
The tape (Binance spot, 16:40 UTC Oct 30, 24h):
$BNB 702.06 (-6.3%), 24h low 680.00
$BTC 77,566 (-4.8%), 24h low 76,500
$ETH 2,238.47 (-5.1%), 24h low 2,174 Snapshot only, not proof of cause.
My take: the reserve number and the Monday PoR report matter more than any screenshot. If withdrawals reopen on schedule and the PoR checks out, the worst-case fear fades. If the date slips, expect another leg of stress.
Are you waiting for the PoR report, or already positioned?
Source: https://tradeassi.com/en/news/d870afcf-e522-4a38-aa59-68b03028fc36
Not financial advice. DYOR.