Binance says hot-wallet breach drained $6.3 billion

Binance says attackers compromised its hot wallets on Oct. 29 and withdrew about $6.3 billion in token assets, a loss the exchange says it will cover for users. In its second security incident update, Binance said the unauthorized withdrawals began at about 20:05 UTC. The exchange has frozen roughly $3 billion on-chain with help from law enforcement, blockchain intelligence firms, asset issuers and industry partners. The scale makes the incident a potential record crypto theft, according to the Associated Press report.

Binance said it has set aside more than $6.34 billion in company funds, including $5 billion in the same token assets that were stolen. The exchange says its Secure Asset Fund for Users and corporate treasury will absorb the loss. Its investigation is ongoing, and its public account of the attack has changed as investigators found further breach points.

How did the attackers get withdrawal transactions through?

Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop. The exchange said the laptop may have let an attacker access a service container and submit unauthorized withdrawal transactions. That describes an access path into Binance’s withdrawal infrastructure; it does not establish that the attacker extracted wallet private keys.

In its Oct. 30 update, Binance said investigators had uncovered “additional points of breach” beyond the possible laptop compromise. The company has not published a complete attack sequence or identified the specific credentials, controls or systems used at each stage. It said it had found no evidence that wallet private keys were leaked. That finding narrows the known failure mode, but it does not explain how the unauthorized transactions passed the exchange’s authorization and security checks.

Binance said it contained compromised infrastructure, revoked affected authorizations and added controls against further unauthorized activity. It also temporarily suspended withdrawals while it reviewed and validated affected systems. Deposits and other unaffected platform services remained operational, according to the exchange’s update.

What can be recovered, and who pays the balance?

Binance said approximately $3 billion had been frozen on-chain by Oct. 30. Freezing can stop assets from moving where an issuer or service controls the relevant token or platform. It cannot reverse a confirmed blockchain transfer by itself, and not every asset has an issuer with a freeze function. Binance has not said how much of the frozen amount it expects to recover.

The company said it had reserved more than $6.34 billion to cover the stolen assets and was buying the remaining token assets through market and over-the-counter channels. That is Binance’s stated plan; the update does not establish that all stolen funds have been recovered or that the replacement assets have already reached affected users.

What remains unknown about the breach?

Binance has not attributed the attack to a named actor in its incident update, and it has not released a technical postmortem. The exchange said it was working with internal and external security experts to establish the full attack sequence and identify contributing factors. It promised further technical findings after verification, subject to concerns that disclosure could affect the investigation.

The distinction matters: the confirmed incident is a compromise of hot-wallet withdrawal infrastructure, with unauthorized transfers and a reported loss of about $6.3 billion. The initial laptop theory is incomplete, the private-key finding is limited to evidence found so far, and responsibility for the attack remains unconfirmed by Binance. Until the exchange publishes its postmortem, the exact control failure that converted access to a service container into approved withdrawals remains unresolved.

Sources and documents

• second security incident update — binance.com
• Associated Press report — apnews.com