Binance details $6.34 billion security incident

Binance said its Oct. 29 security incident affected about $6.34 billion in digital assets, with $2.85 billion frozen or intercepted, in a Nov. 3 incident update. The exchange said it would absorb the financial impact and had set aside more than the amount needed to cover the loss.

How did attackers move assets from Binance wallets?

Binance said attackers gained unauthorized access to an internal wallet signing service and used it to initiate transactions outside the normal withdrawal process. The company’s account says the attackers used malicious on-chain authorizations that could keep moving assets independently of Binance’s usual withdrawal systems.

Between 20:05 and 20:09 UTC on Oct. 29, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address, the exchange said. Its update also reported transfers of about 970,500 SOL, 44.2 million OP and 18,270 BTC.

How much has Binance replaced or frozen?

Binance said 98% of the impacted token assets had been replenished and were verifiable on its Proof of Reserves page as of Oct. 31. It said it was purchasing the remaining, less liquid assets.

The $2.85 billion frozen or intercepted figure is subject to reconciliation and market price changes, Binance said. The exchange also said it had suspended withdrawals during its response and worked with law enforcement and blockchain partners to trace and freeze assets.

What comes next in the investigation?

Binance said its investigation remains ongoing and that independent cybersecurity firms will review its findings. The review is intended to validate the exchange’s account of the incident and recommend further security measures.

The company said it had rebuilt or replaced affected systems and strengthened device controls, wallet-service risk controls and anomaly detection. It said it would share further information as it becomes available.

Sources and documents

• incident update — binance.com