遭遇63亿美元黑客盗窃后 币安分阶段恢复提现并垫付损失Binance Resumes Phased Withdrawals After $6.3 Billion Heist
全球交易量最大的加密货币交易所币安于周日分阶段恢复比特币等主要资产的提现服务。此前，该平台在10月29日遭遇约63亿美元的创纪录网络盗窃，导致数字资产提款一度全面暂停。美国联邦调查局周六发布声明，正式指控朝鲜国家支持的黑客组织TraderTraitor策划并实施了这次攻击。币安方面表示，公司已拨备超过63.4亿美元自有资金并动用用户安全资产基金等储备，已覆盖90%至95%的被盗资产损失，且排名前十的主流代币已获得全额支持，公司承诺由平台自行吸收财务冲击而不让客户承担损失。币安协同行业合作伙伴已冻结约30亿美元受影响资金，而攻击者在约20分钟内将资产转出并通过以太坊与去中心化金融工具推进洗钱。初步调查显示黑客入侵涉及运维工程师笔记本电脑及其他系统漏洞，这起数字资产史上规模最大的被盗事件再次将中心化交易所的热钱包安全脆弱性，以及加密行业缺乏类似传统银行法定存款保险的制度缺位推向风口浪尖。
Binance, the world's largest cryptocurrency exchange by daily trading volume, began restoring customer withdrawals in phases on Sunday following a record cyber heist of approximately $6.3 billion that prompted an immediate suspension of token outflows on October 29. The Federal Bureau of Investigation formally stated on Saturday that the North Korean state-sponsored hacking unit TraderTraitor carried out the attack. In response, Binance announced that it has set aside more than $6.34 billion in corporate funds and tapped its Secure Asset Fund for Users to replenish between 90% and 95% of the stolen assets, pledging to fully absorb the financial fallout so that users incur no losses. While Binance and industry partners managed to freeze about $3 billion in affected funds, attackers moved the bulk of the assets across ten blockchains within roughly 20 minutes and began laundering the proceeds through Ethereum and decentralized finance protocols. Initial investigations pointing to a compromised DevOps engineer's laptop and additional breach points have thrust hot-wallet vulnerabilities and the absence of legal protections like traditional bank deposit insurance back into sharp focus across the crypto industry.
01分阶段重启提现与损失垫付进展Phased Withdrawal Resumption and Loss Absorption
币安在周日清晨启动第一阶段提现，优先开放基于过去一周用户需求排序的资产网络。该平台在社交平台发文称，首批开放的网络为比特币主网，随后逐步恢复以太坊网络与BNB智能链的提现通道。截至美东时间周日上午5点，恢复提现的资产范围进一步扩大至XRP、Base、狗狗币以及Optimism等网络，其余币种提款将在各项安全与稳定性检查完成后分批开放。
Binance launched the first phase of customer withdrawals early Sunday, prioritizing networks based on user demand recorded over the preceding week. In announcements on social platform X, the exchange confirmed that the Bitcoin network opened as the first batch, followed by the resumption of withdrawal channels across the Ethereum Network and BNB Smart Chain. By 5 a.m. Eastern Time on Sunday, withdrawal access had broadened to include XRP, Base, Dogecoin, and Optimism, with remaining token pairs scheduled for restoration as technical stability and security reviews conclude.
在资金储备方面，币安通过动用用户安全资产基金、部分合约保险金以及公司财库，已填补约90%至95%的被盗资产缺口。币安公布的数据显示，BTC、ETH、USDT、BNB、SOL、USDC、XRP、USD1、RLUSD和ZEC等排名前十的数字资产已实现100%全额储备兑付。针对流动性较低的剩余10%资产，币安表示正在通过公开市场和场外交易渠道持续采购相应代币，直至所有受损资产全部完成等额补足。
To replenish depleted reserves, Binance drew from its Secure Asset Fund for Users, a portion of its Futures insurance fund, and corporate treasury holdings, covering between 90% and 95% of stolen assets. The exchange confirmed that its top ten assets—including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC—are 100% backed. For the remaining 10% of affected assets outside the top ten, which involve lower market liquidity, Binance noted that it continues purchasing replacement tokens via market and over-the-counter channels until full coverage is restored.
02FBI锁定朝鲜黑客组织TraderTraitorFBI Blames North Korean Unit TraderTraitor
美国联邦调查局在声明中指出，朝鲜民主主义人民共和国对10月29日币安遭遇的逾60亿美元虚拟资产盗窃事件负有直接责任。联邦执法机构会同美国特勤局和美国国税局刑事调查局发现，具体执行攻击的是朝鲜精锐黑客部队TraderTraitor。据美国财政部信息，该组织隶属于代号为Lazarus Group的更大规模网络部队，长期针对各国政府和金融机构实施破坏性网络行动。面对长期以来的多方指控，朝鲜官方一贯坚决否认参与过此类网络攻击活动。
The Federal Bureau of Investigation announced in a formal statement that the Democratic People's Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29. Federal authorities, working alongside the United States Secret Service and IRS Criminal Investigation, identified the elite unit TraderTraitor as the primary perpetrator. The U.S. Treasury Department considers TraderTraitor to be an operative cell within the broader Lazarus Group, a state-sponsored cyber division that routinely targets international financial institutions and government entities. North Korea has consistently issued official denials regarding any involvement in these cyberattacks.
多家链上安全分析机构迅速印证了美方结论。安全机构TRM Labs表示以高度确信度判定TraderTraitor实施了此次入侵，并指出攻击手法与2025年该黑客组织针对加密交易所Bybit实施的15亿美元盗窃案具有多项高度契合的特征。区块链研究机构Chainalysis首席执行官乔纳森·莱文也在社交平台上公开评估称，本次盗窃极可能由TraderTraitor发起。美方机构同时呼吁私营部门立即协助封锁与该黑客组织关联的所有洗钱地址。
Prominent blockchain intelligence firms corroborated the official attribution. Security firm TRM Labs stated with high confidence that TraderTraitor conducted the breach, emphasizing that key operational traits mirrored the group's 2025 heist against crypto exchange Bybit, which resulted in a $1.5 billion loss. Jonathan Levin, co-founder and chief executive of Chainalysis, independently evaluated the breach on social media, concluding it was likely executed by the same unit. Investigators and federal agencies subsequently urged private-sector exchanges and analytics platforms to actively block transactions connected to addresses designated by TraderTraitor.
03入侵路径分析与被盗资产拦截洗钱链条Breach Vector and Laundering Mechanics
针对此次攻击的技术调查显示，黑客通过入侵一名运维工程师的笔记本电脑，获得了对服务容器的访问权限并提交了未经授权的提现交易，后续调查还发现了多处系统漏洞。安全分析机构TRM Labs指出，攻击者在美东时间周四下午4点05分开始行动，仅用约20分钟便跨越10条区块链转移了约63.6亿美元资产。币安协同行业伙伴迅速采取应对措施，成功冻结了约30亿美元受影响资产，从而阻止了黑客全面掌控这部分数字资金。
Technical reviews into the intrusion revealed that hackers compromised a DevOps engineer's laptop, gaining access to an internal service container to execute unauthorized withdrawals, while subsequent reviews identified additional breach points across systems. According to blockchain analytics firm TRM Labs, the perpetrators initiated the drain at 4:05 p.m. Eastern Time on Thursday, moving approximately $6.36 billion out of exchange wallets across ten distinct blockchains in roughly 20 minutes. Working alongside industry partners, Binance managed to freeze approximately $3 billion in affected tokens, preventing the attackers from taking full possession of those funds.
在转移尚未被封锁的剩余资金时，黑客展现出高度专业化的洗钱链条。美国联邦调查局与特勤局等调查机构观察到，TraderTraitor黑客成员主要将被盗资产兑换为以太坊，并计划借助去中心化金融协议以及即时闪兑服务进行深度洗钱。美方执法部门已要求加密货币交易平台及区块链分析机构对相关可疑清洗地址实施阻截，防止被盗资产彻底隐匿。
For the assets that evaded interception, the perpetrators deployed rapid conversion tactics to obscure transaction trails. The Federal Bureau of Investigation, alongside the Secret Service and IRS Criminal Investigation, observed TraderTraitor operatives converting stolen tokens primarily into Ethereum. Law enforcement agencies warned that the group is using decentralized finance protocols and instant swap platforms to advance these holdings through subsequent laundering phases, prompting official advisories urging exchanges and analytics companies to blacklist addresses tied to the scheme.
币安63亿美元黑客盗窃案始末Timeline of the $6.3 Billion Binance Cyber Heist
梳理币安遭遇史上最大黑客盗窃、锁定朝鲜黑客组织及分阶段恢复提现的关键节点。
Traces key events from the record $6.3 billion Binance breach to FBI attribution and the phased resumption of withdrawals.
黑客入侵DevOps工程师笔记本电脑，在约20分钟内从币安跨10条区块链转走约63.6亿美元，币安随后紧急暂停提现，并联合发行方链上冻结约30亿美元。
Attackers compromised a DevOps engineer's laptop and moved roughly $6.36 billion across ten blockchains in 20 minutes, prompting Binance to halt withdrawals while freezing $3 billion on-chain.
史上最大加密盗窃案导致主流代币价格周五大跌；币安表示充值未受影响，提现将在一两天内恢复，并承诺由平台全额承担所有客户损失。
As major crypto prices fell sharply following the breach, Binance stated deposits remained unaffected and pledged to cover all customer losses with company funds.
美国联邦调查局周六发表声明，认定朝鲜受资助黑客部队TraderTraitor实施了此次攻击；币安同日宣布已备付逾63.4亿美元自有资金以覆盖损失。
The FBI formally attributed the heist to North Korean hacking unit TraderTraitor, as Binance announced it had set aside over $6.34 billion in company reserves to absorb the losses.
币安周日宣布已恢复90%至95%的被盗资产储备，第一阶段提现正式开放比特币、以太坊和BNB等网络，剩余小币种将待安全审查完成后陆续恢复。
Binance began phased withdrawals on Sunday after covering 90% to 95% of stolen assets, restoring networks for Bitcoin, Ethereum, and BNB as security checks concluded.
04交易所托管风险与法规保障缺位反思Custodial Exchange Risks and Regulatory Gaps
与传统银行业拥有联邦存款保险公司最高25万美元的法定保障不同，加密资产持有者在遭遇黑客攻击时无法获得类似的法定补偿体系。塔夫茨大学网络安全政策教授约瑟芬·沃尔夫指出，法律并未强制要求交易所对盗窃实施全额偿付，用户能否追回损失完全取决于平台是否具有偿付意愿和可用资金。金融消费者倡导组织Better Markets政策总监阿曼达·费舍尔也提到，华尔街传统经纪商不仅受到严格监管与定期审计，还必须购买网络保险以确保客户资产安全，而加密交易平台集交易与托管于一身的运作架构使其成为高度集中的网络攻击目标。
Unlike the traditional banking system, where deposits are shielded up to $250,000 by the Federal Deposit Insurance Corporation, digital asset holders face an environment devoid of statutory safeguards. Josephine Wolff, a professor of cybersecurity policy at Tufts University, noted that cryptocurrency platforms operate without legal requirements mandating customer compensation after a breach, leaving account holders reliant on an exchange's voluntary willingness and liquidity to absorb losses. Amanda Fischer, policy director at Better Markets, observed that Wall Street investors hold securities with brokerages that undergo regulatory audits and maintain cyber insurance, contrasting sharply with crypto platforms that combine trading execution and asset custody into a unified, attractive target for hackers.
比特币托管机构Onramp Bitcoin联合创始人迈克尔·坦古马分析指出，黑客盗取的是用于处理日常提款的联网热钱包，其攻击关键在于篡改了提现审核机制。他认为，中心化交易所的脆弱性根植于机构本身，涵盖员工操作、内部审核流程和财务兑付能力；而选择离线自托管虽然避开了平台崩溃的危险，却将风险全盘转嫁给个人，面临设备遗失、备份泄露或人为失误等隐患。将资产转出交易所仅仅是在不同风险形态之间进行置换，而无法彻底消弭安全风险。
The breach mechanics also brought renewed attention to the structural tradeoffs of online exchange storage. Michael Tanguma, co-founder of custody firm Onramp Bitcoin, noted that the stolen tokens originated from internet-connected hot wallets that process routine withdrawals, with attackers manipulating approval mechanisms rather than stealing private keys. Tanguma emphasized that holding assets on an exchange concentrates exposure around corporate employees, approval controls, and platform solvency. While self-custody removes third-party institutional risks, it replaces them with personal hazards such as device loss, compromised recovery phrases, or user error, swapping one vulnerability for another without erasing risk.
