WIRED, citing TRM Labs, reports that most of roughly $6.3 billion stolen from Binance moved in about 20 minutes on October 29. Preparation and test transfers began at least 36 hours earlier, and the theft spanned ten blockchains. Alongside delegated signing on Ethereum, other chains recorded ordinary validly signed transfers, leading TRM to suggest a compromise of shared signing infrastructure. Binance said it was investigating additional breach points beyond an initially suspected laptop. Analysts’ North Korea attribution is not a confirmed law-enforcement finding, and freezing some assets is not equivalent to recovering the entire loss.