Actualización del hackeo de Binance: se reservan 6.340 millones de dólares, señalan a Corea del Norte y fijan el domingo como objetivo para los retiros

Tradeassi_com · 2026-10-30T16:47:04.000Z

Ayer alertamos de una presunta sustracción de fondos de las billeteras calientes de Binance, con estimaciones de entre 2.500 y 5.800 millones de dólares y sin confirmación. En las últimas 24 horas, la situación se ha aclarado: se confirmó el hackeo, la magnitud es más precisa, Binance ha dicho quién pagará y los investigadores han señalado a un sospechoso. La magnitud: TRM Labs calcula el robo en unos 6.360 millones de dólares, retirados de las billeteras de Binance en 10 cadenas de bloques; la mayor parte, en unos 20 minutos a partir de las 20:05 UTC del jueves. Chainalysis lo cifra en unos 6.400 millones de dólares. Eso lo convierte en el mayor robo de criptomonedas registrado, aproximadamente cuatro veces más que el hackeo de Bybit de febrero de 2025, en el que se robaron 1.500 millones de dólares.

Yesterday we flagged a suspected drain from Binance hot wallets, with estimates from $2.5B to $5.8B and no confirmation. In the last 24 hours the picture firmed up: the hack is confirmed, the size is clearer, Binance has said who pays, and investigators have named a suspect.
The size:
TRM Labs puts the theft at about $6.36B, moved out of Binance wallets on 10 blockchains, most of it in about 20 minutes from 20:05 UTC Thursday. Chainalysis puts it at about $6.4B.
That makes it the largest crypto theft on record, roughly four times the $1.5B Bybit hack of Feb 2025.
Who (per the analytics firms):
TRM ("high confidence") and Chainalysis both attribute it to TraderTraitor, the North Korean group the FBI blamed for Bybit.
Chainalysis says it saw stolen Binance funds commingling in real time with proceeds of last month's Bitget exploit. North Korea has denied past hacking allegations.
How:
On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper, with 50 pre-signed authorizations prepared in advance (TRM).
On the other nine chains, funds left through ordinary signed transfers, which TRM reads as a compromise of Binance's hot-wallet signing infrastructure.
Binance says its investigation began with a compromised engineer's laptop and has since found "additional points of breach".
Who pays:
Binance says it has reserved more than $6.34B of company funds to cover user losses. About $5B is already held in the exact tokens that were stolen; the rest is being bought via market and OTC, which may take longer for low-liquidity tokens. Frozen assets are not counted in that figure.
Frozen vs still loose:
Tether, Circle, Ripple and World Liberty Financial froze about $2.67B in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6M ARB (TRM). Binance puts the total frozen at about $3B.
The attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4B beyond any issuer's reach.
What to watch next:
Withdrawals are still paused. Co-CEO Richard Teng is targeting a restart by Sunday, within about 40 hours of his Friday remarks, but only if the rebuilt withdrawal service passes testing (The Defiant).
Teng also promised a full Proof of Reserves report by Monday.
Any large sales of the unfrozen ETH and BTC would hit spot liquidity.
The tape (Binance spot, 16:40 UTC Oct 30, 24h):
$BNB 702.06 (-6.3%), 24h low 680.00
$BTC 77,566 (-4.8%), 24h low 76,500
$ETH 2,238.47 (-5.1%), 24h low 2,174 Snapshot only, not proof of cause.
My take: the reserve number and the Monday PoR report matter more than any screenshot. If withdrawals reopen on schedule and the PoR checks out, the worst-case fear fades. If the date slips, expect another leg of stress.
Are you waiting for the PoR report, or already positioned?
Source: https://tradeassi.com/en/news/d870afcf-e522-4a38-aa59-68b03028fc36
Not financial advice. DYOR.