SE-BINANCE-SECURITY-001 · public record v0.2 · publication 7
A security incident is not one number.
This time-bounded record separates what Binance said, what one Ethereum query independently returned, what analytics inferred, what syndicated media repeated, and what remains unestablished about impact, transferred assets, freezes, recovery, compensation, reserves, root cause and attribution.
Last source check: . No material evidence-state change was found. The six open claims remain open.
Case JSON · Source registry v0.1 · Fresh source review · Claims and closure tests · Publication approval
Metric discipline
Similar figures, different evidence boundaries
IMPACT ≠ STOLEN ≠ FROZEN ≠ RECOVERED ≠ COMPENSATED
Atomic claims
Four bounded supports; six open claims
Binance published a preliminary incident account.
Supports the statement's existence, not independent root-cause proof.
Reviewed estimates cluster near $6.3B.
The exact value remains dependent on chain, token, label and price-time rules.
The frozen amount is not reconciled.
~$3B operator estimate versus ~$2.7B analytic counts under stated cutoffs. Closure requires a transaction-level freeze ledger.
Compensation was promised, not observed as complete.
Closure requires evidence of completed eligible-user restoration and reconciliation, not a promise.
Root cause remains preliminary.
Closure requires a reviewable post-mortem, relevant trust boundaries and supporting custody or audit logs.
One Ethereum execution is independently anchored.
Successful transaction, receipt and block time; no ownership or total-loss inference.
North Korea / TraderTraitor is a TRM attribution.
Closure requires attributable primary evidence or multiple independent, reviewable intelligence disclosures.
Nine chains versus ten remains unreconciled.
Closure requires a chain-by-chain inclusion matrix, including Avalanche and cluster rules.
Post-incident reserve and liability coverage is not established.
Closure requires pre/post PoR snapshots, liabilities methodology, incident adjustments and reproducible reconciliation. No solvency inference.
Eastmoney republished 财联社 reporting about market reaction and different figures.
This is one syndicated lineage. It supports what the page reported, not each repeated figure or causal claim.
Independent public-ledger observation
What the Ethereum query establishes—and what it does not
Observed: transaction 0x53bd38…e2f3, block 26300770, timestamp , successful receipt, 64 logs.
Not established by this object alone: wallet ownership, decoded total value, incident-wide loss, root cause, intent, actor identity, or amounts frozen, recovered, returned or compensated.
State transitions · all timestamps UTC
The evidence state changed over hours
- Included outflows begin.
Analysts preserve a one-minute difference in first-event timing.
- Ethereum execution independently anchored.
Public-node observation, not a full incident reconstruction.
- Issuer freeze actions reported.
Frozen remains distinct from recovered and compensated.
- Withdrawal pause reported.
Original notice timestamp not captured in this packet.
- Binance preliminary notice.
Impact, freeze and compensation statements remain operator-attributed.
- Public analytic reconciliations available.
Nine/ten-chain and ~$3B/~$2.7B differences remain visible.
- Initial research cutoff.
Root cause, attribution, reserves and compensation remained open.
- Pre-publication source review.
No material evidence-state change; all six open claims retained.
Source registry
Eight records; three independent non-operator originators
Independence is counted by originating lineage, not by URL count. TRM, Bitquery and the Ethereum public ledger are three non-operator originators. Eastmoney republishes 财联社 and is not counted again. The three Ethereum records are one ledger lineage. Binance's notice and PoR page are one operator lineage.
| ID | Source | Lineage | Boundary |
|---|---|---|---|
| BSEC-S001 | Binance incident update | Operator primary · Binance lineage | Normalized public-index capture; no full raw-page verification |
| BSEC-S002 | TRM analysis | Independent analytic originator | On/off-chain inference; attribution not reproduced |
| BSEC-S003 | Bitquery investigation | Independent analytic originator | Declared cutoffs and nine-chain scope |
| BSEC-S004 | Eastmoney / 财联社 | Syndicated media · one lineage | Derivative report; underlying Glassnode source missing |
| BSEC-S005 | Binance proof of reserves | Operator method · same Binance lineage | Dynamic snapshot fields unavailable; no incident-specific snapshot verified |
| BSEC-S006–S008 | Ethereum tx / receipt / block | Independent public ledger · one lineage | Object-level observation only |
Decision-evidence gap · BSEC-DG001
Does public evidence establish post-incident liability coverage and completed compensation?
Status: OPEN — insufficient public evidence.
- Capture and hash the original pre-incident reserve snapshot, Merkle root and address bundle.
- Reconcile outflows, freezes, rescues, recoveries, returns and compensation without double counting.
- Capture the promised post-remediation proof of reserves and technical post-mortem.
- Add independently reviewable liability scope and exclusions.
- Record completed user restoration rather than relying on a promise.
No solvency, insolvency, safety, negligence, criminal or actor conclusion follows from the open state.
Research boundary: This public record is informational, time-bounded and incomplete. It is not investment, legal, compliance, accounting, cybersecurity or solvency advice; not a recommendation, forecast, rating or certification; and not a determination of liability, negligence, criminal conduct or actor identity. Public address labels and analytic attribution may be incomplete or revised. Review the linked source records before relying on any statement.