Binance Reports $6.3bn Security Breach, Says It Will Cover All Customer Losses
Cryptocurrency exchange Binance has disclosed an estimated $6.3 billion security breach involving unauthorised withdrawals from its cryptocurrency wallets, saying it will cover all resulting losses with funds from its emergency reserve and company resources.
The exchange disclosed the incident in a security update published on Friday, October 30, saying its preliminary investigation suggested that an attacker might have gained access to its internal systems through a compromised laptop belonging to a DevOps engineer.
According to Binance, the suspected compromise allowed the attacker to access a service container and submit unauthorised withdrawal transactions.
The company said it had found no evidence that any wallet private keys were leaked, but added that investigations were continuing to establish the full circumstances of the incident.
Binance estimated the total financial impact at approximately $6.3 billion, adding that it had worked with blockchain partners to freeze about $3 billion in affected assets on-chain.
The exchange said it would absorb all losses through its Secure Asset Fund for Users (SAFU) and company funds.
“User funds are safe,” the company said, while promising to publish an updated Proof of Reserves after completing its remediation efforts.
Withdrawals suspended as investigation continues
As part of its immediate response, Binance temporarily suspended deposits and withdrawals while carrying out security checks.
It also revoked the authorisation associated with the affected address and engaged law enforcement agencies and blockchain intelligence partners to trace and recover the assets.
In a subsequent service update on Friday, the exchange said deposits were operating normally but withdrawals remained suspended as it worked on strengthening its withdrawal service and related addresses.
Binance said it expected to resume withdrawals within 48 hours, although the timeline remained subject to the completion of its security measures.
The company also promised to release a detailed technical post-mortem after its investigation had been completed and the findings verified.
Investigation points to possible North Korean hackers
Separately, blockchain intelligence firm TRM Labs estimated that approximately $6.36 billion was moved from Binance wallets across 10 blockchain networks during the incident.
In an investigation published on October 29, the firm attributed the attack to TraderTraitor, a hacking unit associated with North Korea.
TRM said its assessment was based on on-chain and off-chain intelligence, describing its confidence in the attribution as high.
The firm’s analysis indicated that the attacker moved funds across several blockchain networks, including Ethereum, Bitcoin, Tron, the XRP Ledger and Solana.
It also identified the use of sophisticated transaction authorisation techniques involving Binance’s Ethereum hot wallet.
However, Binance has not officially identified the perpetrators. Its announcement said it was working with law enforcement agencies to establish the identities of those responsible.
Questions emerge over cryptocurrency reserves
Although Binance has maintained that customer funds are safe, the incident has raised questions about the relationship between its affected wallets and the assets backing customer balances.
An examination of Binance’s published reserve information by cryptocurrency news outlet CoinDesk found that some of the wallets affected by the incident appeared in the exchange’s October 1 Proof of Reserves.
The analysis raised concerns that the withdrawals could have temporarily reduced the backing of certain cryptocurrency balances below full coverage until the missing assets were replaced.
Binance has promised to publish an updated Proof of Reserves after completing its remediation process.
The disclosure is expected to provide further information about the exchange’s holdings following the incident.
The development has also drawn attention to the role of internal security systems in cryptocurrency exchanges, particularly the infrastructure used to authorise withdrawals and protect digital assets.
For now, Binance says it is working with law enforcement agencies, blockchain intelligence firms and other industry partners to recover affected assets and strengthen its security systems.
