Binance confirms $6.3 billion hack and suspends withdrawals

Binance said on Oct. 30 that attackers stole about $6.3 billion from its hot wallets after compromising them the previous day, in what appears to be crypto’s largest theft on record, according to The Associated Press. A hot wallet is a crypto wallet connected to the internet.

• About $6.3 billion in token assets was stolen.
• Roughly $3 billion has been frozen on-chain.
• Binance set aside more than $6.34 billion to cover the losses.
• Withdrawals were temporarily suspended for security checks.

How much of the stolen crypto has been frozen?

Binance said roughly $3 billion of the affected assets had been frozen by Oct. 30, as it worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners. A freeze blocks transfers from affected addresses, but it does not mean the money has been returned to Binance.

The company’s security incident update put the loss at about $6.3 billion and said the compromised hot wallets were accessed at around 20:05 UTC on Oct. 29. Binance said more than $6.34 billion in company funds had been set aside to cover the stolen assets, including $5 billion in the same tokens that were taken.

That amount, Binance said, covered about 80% of the impact at the time of its update. It was buying the remaining tokens through market and over-the-counter channels. The exchange said it would cover all losses through its Secure Asset Fund for Users, known as SAFU, and its corporate treasury.

What services did Binance suspend?

Binance temporarily suspended withdrawals while it reviewed security and repaired affected systems. The company said deposits and other unaffected services remained operational. Its update did not say that trading had been halted.

The exchange said its team was working to restore withdrawals in phases, with a target to begin resuming them in about 34 hours, subject to security checks. That was a target, not a confirmed reopening time. The company said it would publish updates as each phase became available.

Binance’s stated plan also included a new proof-of-reserves snapshot, a report intended to show platform asset holdings and the backing for customer balances. It expected to have that report ready by Nov. 2. The company said it would later publish a technical account of the incident and the safeguards it planned to add.

How did attackers get into Binance’s systems?

Binance said its initial investigation pointed to a compromised laptop, but later work found additional points of breach. The company had not established the full attack sequence and said it expected to share more technical findings within about 48 hours, once verified.

Binance said it had found no evidence that wallet private keys were leaked. The company did not identify the attackers in its update. AP reported that blockchain intelligence firms had linked the theft to TraderTraitor, a North Korean hacking unit, but Binance said it was working with law enforcement to confirm who was responsible.

The exchange said the investigation was ongoing. For customers, the immediate questions are whether withdrawals can resume on schedule and whether more of the frozen assets can be recovered.

Sources and documents

• The Associated Press — apnews.com
• security incident update — binance.com