What was affected. What is restricted. What we still don’t know.
Partial on-chain tracking. Official estimates are reviewed snapshots.
Official estimates ·
Read Binance’s statement. Observed by . Asset breakdown and valuation time are not supplied. These are reported claims, not our reconciled ledger.
Independent observations remain limited.
Two Ethereum token contracts monitored below.
Verified return to victim control.
Proven destruction or spending impossibility.
No global traced balance or residual established.
Balances in token units, not dollars
One address identified in Blockaid’s investigation. Contract state is independently queried; complete incident-proceeds lineage is not verified.
Curated baseline · automatic check pending · historical observation
1175.46M USDT
Exact balance: 1,175,464,712.775362 USDT
Transfer restriction observed for this token and address.
823M USDC
Exact balance: 823,000,000.000000 USDC
Transfer restriction observed for this token and address.
Monitored address: 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
Comparable observations of these two contracts only.
The first verified observation is preserved. Automatic checks update current balances; a durable historical series is not yet collected. Official estimates from different sources are not trend points.
Latest official statement verified here: . This notice was rechecked . Curated status; check Binance for later notices.
Binance says it will cover losses using SAFU and company funds. That commitment is not independently verified here.
Official operational update · Observed by .
Blockaid identifies the collection address and sweep. The Ethereum receipt confirms a USDT transfer of 1,615,409,498.973240 units into this address, not the full incident total. View transaction.
TRM reports $6.36B at transfer-time prices across ten chains, $6.23B at its later marks and about $2.7B restricted. Different valuation bases and scope prevent a combined allocation. Read analysis.
Reported impact, freezes, operational suspension and loss-coverage commitment. Read statement.
At Ethereum block 26302943, both monitored token contracts report the address as blacklisted. This is a token restriction, not a chain halt or recovery.
Reported estimates retain their publisher, date and valuation caveats. Our observations query an allowlist of two Ethereum contracts at one finalized block. They must not be added to the official frozen estimate: overlap is unresolved.
| Measure | What it means | What it does not prove |
|---|---|---|
| Affected | Original incident inventory or attributed estimate. | A current market valuation or exact remaining loss. |
| Frozen | A verified token transfer restriction at a specific block. | Funds returned, permanent destruction or a network halt. |
| Recovered | Evidence that funds returned to victim control. | Exchange arrival alone does not establish recovery. |
| Unusable | Demonstrable permanent spending impossibility. | A reversible blacklist is not permanent. |
| Movable | Traced units with reviewed transferability evidence. | An unset blacklist alone does not prove unrestricted use. |
| Unknown | Unresolved amount, lineage, control or coverage. | Unknown is never treated as zero. |
PublicNode supplies finalized Ethereum block data, balances and blacklist flags. Checks are coalesced within each Worker instance and cached for at least 60 seconds. Failed or invalid responses retain the last good observation and its original time. A bundled reviewed snapshot survives restarts; a newer in-memory result may not. The interface polls one normalized endpoint while visible. It never queries RPC providers from your browser.
Original affected estimates, current token balances, prices, chains and source scopes do not reconcile. We do not subtract them to invent a movable or recovered remainder. Tokens are retained as exact integers and displayed with six decimals; no $1 peg is assumed.
Bitcoin and all other chains, additional wallets, swaps, bridges, collateral, debt and recovery recipients remain outside this tracker’s automated view. Balances at the monitored address are not proof that every unit came from the incident. Changes need tracing before they can be called sales or returns.
TRM assesses North Korean involvement. Binance’s preliminary root-cause statement and Blockaid’s initial interpretation differ. This dashboard does not settle identity or root cause.
The Binance notice was retrieved through its public CMS endpoint. Its observation time is an upper bound after retrieval. Sources can change after review.