Does the $9.6 billion tally confirm who caused the Binance outflow?

Read each number with its own scope

The $9.6 billion figure covers a period beginning in 2019. The roughly $6.4 billion figure concerns the Binance incident within that historical total. About $3 billion is described as frozen within the Binance amount. These scopes answer different questions: the historical size of a category, one incident's place in it and the reported restriction of part of the incident-related funds. PANews gives the three amounts.

Using the rounded inputs, $6.4 billion divided by $9.6 billion equals about 66.7%, consistent with the report's description of roughly two-thirds. That is arithmetic on the reported numbers. It is not a new measurement of wallet balances. Because both inputs are approximate, writing several additional decimal places would suggest a level of precision the source does not provide.

The same arithmetic leaves about $3.2 billion when the reported Binance component is subtracted from the reported historical total: $9.6 billion minus $6.4 billion. Treat that as a difference between rounded figures. It does not identify the remaining wallets, reconstruct every historical incident or show which assets remain recoverable.

PANews lists other entries, including Bybit at about $1.4 billion and the Ronin bridge at $624 million. We retain those as entries in unfolded's reported classification, with its source attribution attached. They should not be used to imply that every entry has the same investigative status or that every estimate uses an identical valuation method. The report does not supply the methodology needed to make that stronger comparison. The incident examples appear in PANews.

For a reader comparing a new headline with an earlier one, start by writing down the subject beside the amount. Is the figure a historical total, the estimated size of one incident, or a frozen portion? Only compare figures after matching that subject. A larger number in a later article cannot, by itself, show that the suspected incident grew by the difference.

Attribution still needs its own evidence

The qualification in unfolded's tally concerns recent incidents including Binance, Bitget and Drift. According to both reports, their attribution mainly comes from security companies and has not been confirmed by the FBI. We have not opened those companies' underlying investigations for this article, so we do not describe their evidence, identify a particular attacker group or present their conclusions as an official determination. Odaily carries the qualification.

An account holder should read the words “North Korea-linked” as the classification attached to this reported tally. The article does not supply an FBI finding about the recent Binance event. It also supplies no statement from Binance accepting that characterization. Describing the current event as a suspected incident preserves the question that the available reporting leaves unresolved.

The distinction changes which follow-up documents would answer the reader's next question. To assess the attribution, look for the named security investigation and the evidence it presents. To assess the exchange's response, look for its own incident statement. To assess your transfer, use the actual transfer record. One of those documents cannot stand in for all the others.

Avoid adding a technical attack explanation to the tally. Neither report supplies transaction-level evidence of the method used in the Binance event. A historical ranking cannot establish how access was obtained, which systems were involved or what the exchange has repaired. Those details would require separate sources before they belonged in an explanation of this event.

What the reported $3 billion freeze leaves unanswered

PANews says about $3 billion of the Binance-related amount has been frozen. Dividing that rounded figure by the reported $6.4 billion gives about 46.9%. The calculation describes the relationship between the two figures in this report. It cannot show how much any customer will receive or when an account balance might change. PANews attributes the freeze amount to unfolded.

Subtracting the reported frozen portion leaves about $3.4 billion: $6.4 billion minus $3 billion. Use that result only as a remainder within this tally. Calling the whole remainder permanently lost would add a conclusion the source does not establish. Calling all the frozen portion recovered would add a different unsupported conclusion.

The reports do not provide an asset-by-asset freeze list, the legal terms governing release or a distribution schedule for users. They do not connect the aggregate frozen amount to a specific customer's balance. If you are waiting for a transfer, the next useful evidence is a status update for that transaction or an official instruction relevant to that asset, not a percentage calculated from a historical summary.

Keep separate notes for the original estimated amount and later recovery claims. If a later source reports a return of assets, record the asset, quantity, recipient and time it actually verifies. Do not silently subtract it from this tally unless the scopes match. That practice lets you follow a developing incident without turning every new figure into a revised final loss.

Check your own balance and pending transfer

Use these checks for an existing Binance transfer:

1. Open the app or saved address you normally use; record the asset and available balance.
2. For a pending withdrawal, save the request identifier, network, amount and displayed status. Use those details when asking support.
3. If a transaction hash is shown, compare its network and destination with your intended transfer; if none is shown, preserve the request record and status message.

A news report about frozen funds does not establish completion of your withdrawal. The tally contains no transaction-specific information.

Before submitting another request, check the existing one. If the interface offers a cancellation option, read its current conditions in the account before acting. The two tally reports contain no withdrawal timetable or account-specific cancellation conditions. Keep a support request focused on the particular transfer, with its identifiers and timestamps.

For any timestamp you save, record its timezone. Odaily's report is stamped 23:53 SGT on October 30; that is the publication time of its account, not a timestamp for your funds moving or a freeze taking effect. When comparing your records with later incident updates, match the event time being described as well as the timezone. Odaily shows the publication stamp.

Treat compensation messages as a separate verification task

Be wary of messages claiming to unlock “Binance compensation” or accelerate recovery. Do not follow an unsolicited direct-message link to enter account credentials, reveal a wallet recovery phrase or sign an unexplained transaction. Begin any claim check from the official channel you normally access. The tally reports provide no compensation application or eligibility rules.

If a message cites the $9.6 billion tally or the $3 billion freeze as proof that you qualify for payment, check the missing connection: where is the official instruction covering your account and asset? The opened reports provide no compensation application, claim deadline or payment eligibility. We therefore give no claim link and no steps for applying to a recovery scheme. PANews's report concerns the tally.

Keep a suspicious message separate from your genuine support correspondence. If you ask support to assess it, preserve the message and the destination it proposed without opening a new account session through that link. A request for a recovery phrase, an extra transfer or a signature deserves its own verification before any action. The reported frozen amount does not authorize it.

Quick answers

Which updates would establish attribution or recovery?

A published underlying investigation could explain why the recent Binance incident was included in the attribution category. An official incident statement could clarify the exchange's own classification and asset accounting. A documented asset return could establish a recovery step. Until those materials are opened and assessed, the defensible description remains unfolded's reported historical tally with the qualification its reports carry.

Does the tally measure current trading pressure?

If your question concerns market exposure, inspect the positions you actually hold and the orders attached to them. The tally does not measure current funding costs or liquidation pressure. Use the liquidation board and funding-rate board for those separate questions, reading the instrument and time shown there. We do not infer a market move, cause or trading signal from the historical amounts.

What record should I keep for a pending transfer?

For a pending Binance transfer, retain the request record and follow the existing incident tracker for subsequent sourced updates. The next check is whether an update addresses your asset, network and transaction status. A change in the historical tally alone cannot answer those account-specific questions.