Skip to content
Blockchain Posts

exploit

Binance pledges $6.34B reserves and Sunday restart as Arbitrum freezes $30.5M

Binance's Richard Teng says the exchange reserved $6.34B to cover the Oct 29 drain and targets Sunday for withdrawal restart. Arbitrum's Security Council froze another $30.5M of attacker funds.

by 5 min read
exploitbinancearbitrumon-chain

A day after an EIP-7702 sweeper drained roughly $6.3B from Binance hot wallets (our write-up), the response has firmed up. Co-CEO Richard Teng says Binance has $6.34B of its own funds reserved to cover user losses, targets Sunday for withdrawals to reopen and a full proof-of-reserves (PoR) by Monday, while Chainalysis and TRM Labs have both publicly attributed the drain to North Korea's TraderTraitor with "high confidence." On Ethereum L2 Arbitrum, the Security Council pushed through an emergency protocol action that froze another ~$30.5M of stolen funds — raising on-chain seizures to >$2.83B per ZachXBT.

What happened — the response layer

  • Reserve capacity: Binance has set aside $6.34B of its own funds, roughly $5B of it already in the affected tokens (ETH, BTC, USDT, USDC and others) with the balance being bought via market and OTC desks. The exchange's SAFU fund — about $1B in BTC — is also being tapped. This is additive to the ~$3B frozen on-chain by issuers (Tether, Circle, Ripple, WLF) and bridges.
  • Reopening: Teng is targeting Sunday for withdrawal restart; deposits have been running normally since Friday morning UTC. A full PoR snapshot is promised by Monday.
  • Attribution hardens: TRM Labs attributes to TraderTraitor with high confidence, citing Tornado Cash funding of the operational wallet, EIP-7702 delegation that mirrored the group's prior sweeper work, and 50 pre-signed authorizations consistent with Bybit-style staging. Chainalysis independently cites real-time commingling of the Binance drain with proceeds from the September Bitget exploit — previously attributed to the same group — plus automated laundering patterns matching Kelp DAO and Bybit. Singapore-based Pangolin Intelligence reaches the same conclusion. Neither OFAC nor the FBI has issued a formal designation as of writing.
  • Breach scope widens: Teng told reporters the attack "was not a single 'one-click' action" and "did not simply use one engineer's permissions," signaling the forensic picture is broader than the DevOps-laptop story Binance put out Thursday night. No individual has been identified; the exchange says private keys were not stolen.

Mechanism — how Arbitrum froze another $30.5M

Separately, the Arbitrum Security Council executed an emergency action at 00:08 UTC on Oct 30 that moved 8,425 ETH and 74,559,805 ARB — roughly $30.5M — out of attacker reach:

  1. The Council (12 members, 9-of-12 threshold) temporarily modified the Inbox contract on Ethereum.
  2. It submitted two transactions on behalf of the target address — one for the ETH balance, one for the ARB — forwarding the funds to an address ending 0DA0.
  3. The Inbox was then restored to its original implementation.

Future movement of the frozen funds requires a full Arbitrum governance vote.

Mechanically, this is the first time Arbitrum has used the Security Council's protocol-upgrade powers to freeze attacker-held funds rather than to patch a vulnerability. The constitutional provision was always there; the political test — using it against a wallet rather than a bug — had not been run.

Numbers block

  • Binance reserve pledge: $6.34B (CoinDesk) — ~$5B already in affected tokens, rest bought market/OTC.
  • SAFU draw: ~$1B BTC.
  • Partner freezes: ~$3B across Tether, Circle, Ripple, World Liberty Financial (USDT, USDC, RLUSD, USD1).
  • Arbitrum SC seizure: 8,425 ETH + 74,559,805 ARB (~$30.5M).
  • Total frozen on-chain: >$2.83B (ZachXBT, aggregating issuers + Arbitrum SC + partners).
  • Attacker wallet still at liberty: >420,000 ETH + 18,270 BTC ($2.4B) per TRM/Chainalysis — beyond issuer-freeze reach for BTC and part of ETH.
  • Withdrawal restart target: Sunday.
  • Next PoR snapshot: Monday.

What to watch

  1. Does Sunday hold? Teng's calendar is tight: migrating affected wallets to new keys, settling with issuers that froze user balances mid-transfer, and shipping a verifiable PoR all have to happen inside roughly 36 hours.
  2. The Monday PoR. The exchange's reserve ratios on affected tokens dropped below 100% before replenishment landed; the snapshot will show whether Binance equity + SAFU + market buys have refilled the hole or whether a gap remains.
  3. An OFAC or FBI attribution. Private-sector attribution is three-firm consistent. A formal designation would add sanctions obligations for other exchanges holding attacker funds.
  4. Follow-on freezes. The remaining ~$2.4B at the attacker's addresses is mostly BTC and un-frozen ETH; the only paths off are bridges, DEXs and mixers, each of which can be surveilled.
  5. DeFi venues' posture. Aave V3 Ethereum has frozen the relevant markets and Kamino paused its SOL/BTC market; a reopening calendar depends on attacker-address blacklists landing in the relevant risk oracles.

Context — the Security Council precedent

Arbitrum's Security Council action matters beyond this incident. The DAO ratified the Council's emergency powers precisely for cases a vote cannot reach in time — but using them against a user address, rather than a protocol bug, sits in a political gray zone the DAO has not previously tested. Expect governance posts in the coming week arguing both the "we had to" and the "this normalizes freezes" sides. The Council's own report is explicit that any onward movement of the frozen funds needs a full governance vote — a procedural circuit-breaker against the obvious slippery-slope read.

Sources

Related stories