Binance suspends withdrawals after $6.3 billion hack

Binance says hackers stole about $6.3 billion in token assets from its hot wallets on Oct. 29, and the exchange has suspended withdrawals while it checks affected systems. The company says it will cover the losses, but recovery remains uncertain: about $3 billion has been frozen, and the investigation is still developing. CoinDesk’s report on the breach put Binance’s estimate at about $6.3 billion and described it as the largest crypto theft on record.

What failed inside Binance’s wallet systems?

In its Oct. 30 security update, Binance said the incident began at about 20:05 UTC on Oct. 29, when its hot wallets were compromised and unauthorized withdrawals followed. Its initial investigation pointed to a possibly compromised laptop; Binance now says investigators have found additional points of breach. The exchange has not published a complete account of how the attacker gained access.

Binance said it had found no evidence that wallet private keys were leaked. Its earlier explanation, reported by CoinDesk, said access to a service container may have let an attacker submit unauthorized withdrawal transactions. That distinction matters: the exchange has described a route through its systems, but the available findings do not yet establish the full attack sequence or whether other controls failed.

How does the loss compare with Binance’s response?

The company says it has set aside more than $6.34 billion to cover the stolen assets, including $5 billion in the same tokens that were taken. It says the balance will be bought through market and over-the-counter channels. That commitment is meant to protect customers from bearing the direct loss; it does not mean the stolen tokens have been recovered. Binance says roughly $3 billion has been frozen on-chain through work with law enforcement, blockchain intelligence firms, issuers and other industry partners.

That response differs from relying only on recovery: Binance says its Secure Asset Fund for Users and corporate treasury will absorb the loss. The operational pause is narrower than a full platform shutdown. The company says withdrawals are suspended for security reviews, while deposits and other unaffected services remain operational. That preserves some platform access, but users cannot move funds out until withdrawals resume.

Recovery also depends on the type of asset and where it moves. CoinDesk reported that stablecoin issuers Tether and Circle froze funds, while the attacker’s wallets also interacted with decentralized trading and lending services. Issuers can block transfers of their stablecoins, but decentralized services let users transact directly from wallets without a centralized exchange processing each trade. Those routes complicate intervention; transfers alone do not show whether the assets can still be frozen or recovered.

What should users watch next?

Binance says it is targeting a phased restart of withdrawals in about 34 hours, subject to security checks. It expects to share further technical findings within about 48 hours and says it plans a proof-of-reserves snapshot, with results due by Monday, Nov. 2. Those dates are targets, not completed steps. The key signals are whether withdrawals return on schedule, whether the reserve report supports the company’s coverage pledge, how much of the frozen $3 billion is recovered, and what the eventual postmortem says about the breach.

Sources and documents

• CoinDesk’s report on the breach — coindesk.com
• Oct. 30 security update — binance.com