Connected Situation / Through 2026-10-31

Binance Theft, Fund Freeze and Withdrawal Suspension

stories: 4
events: 4
entities: 16
connections: 4

Evidence so far on 2026-10-31 UTC · updated 2026-10-31 03:27 UTC · analysis as of 2026-10-30 17:22 UTCSign in for the live Situation ↗

Narrative

As-of analysis

Carried forward

Situation at a glance

On 2026-10-30, a coded Event titled “TraderTraitor steals billions from Binance wallets” describes a significant cyberattack on Binance; it names TraderTraitor as source actor and North Korea as source-actor country. [Event] Stories that day reported a $6.3 billion heist, with one headline saying North Korea’s Lazarus Group was suspected and another saying North Korea was blamed. [Stories] Separately, “Binance freezes $2.54 billion in crypto funds amid security probe” reports a freeze amid a probe, not a freeze of the full reported theft amount. [Story] “Binance suspends withdrawals after multibillion-dollar hack; Singapore investor impact unclear” reports a withdrawal suspension and says the effect on Singapore investors was unclear. [Story] Binance is the Event’s recorded target. [Entity, Event]

Footnotes[6][2][4][3][1][5][7]

Assessment

The central supported account is a Binance cyberattack and related response: the Event identifies Binance as target, while the freeze and withdrawal stories connect the incident to Binance’s actions. [Event, Stories, connection] The $6.3 billion figure belongs to heist reporting; the separately reported $2.54 billion figure describes frozen funds, so the two amounts should not be conflated. [Stories] Attribution is not uniform: the Event names TraderTraitor and assigns North Korea as source-actor country, while headlines describe Lazarus Group as suspected and North Korea as blamed; these do not establish a confirmed identity. [Event, Stories] The Singapore headline expressly leaves investor impact unclear, and the selected evidence does not establish the extent of any such impact. [Story]

Footnotes[6][2][4][3][1][5][9][10][11][12]

Explanation originally captured 2026-10-30 · Evidence through 2026-10-31 UTC · Source edition sed_6fb9ad8427818bbcbc9820cdc3b8ed79

What informs this explanation

Complete retained Story and Event membership
Daily reporting and coded-occurrence time steps
Event taxonomies, metrics, units, and denominators
Canonical Entities and recorded actor/target bindings
Typed reporting, membership, and incident edges
Changes against the preceding retained edition
Permitted macro, public-record, and asset facts only when they were retained with an explicit source and observation date

Quantitative

Evidence in numbers

This retained edition

Scope
A 3-day Situation represented by 4 coded Events carried across 4 member Stories.
Coded activity
The coded activity is led by TE03 · Cyber Event (4).
Prominent subjects
Binance is prominent in the retained actor and relationship evidence.
Entity coverage
16 canonical Entities are linked to this edition.

Metric coverage. 4 coded Events · 4 CAMEO+ · 0 conflict. The four dimensions describe the CAMEO+ subset; conflict Events do not carry these scores.

Magnitude4.8

min 2max 6

4 measured

Systemic importance0.39

min 0.27max 0.5

4 measured

Propagation potential0.37

min 0.26max 0.42

4 measured

Market sensitivity0.6

min 0.5max 0.7

4 measured

Dot = mean · shaded span = observed range · position uses each metric’s defined scale.

All 6 scores, distributions & definitions

How the coder scored the full retained Event set

4 coded events — 4 CAMEO+

Significance · 40.49
min 0.3max 0.59
Magnitude · 44.8
min 2max 6
Systemic · 40.39
min 0.27max 0.5
Propagation · 40.37
min 0.26max 0.42
Market · 40.6
min 0.5max 0.7
Confidence · 40.68
min 0.52max 0.79

No conflict-family event here, so nothing carries a fatality count — a missing column, not a toll of zero. 4 sit outside POLITICAL, where Goldstein and quad class are undefined.