Skip to main content
Blockfront

Crypto markets, protocols and policy

Binance says $6.3 billion stolen in hot-wallet hack

Binance says attackers stole about $6.3 billion from its hot wallets; roughly $3 billion is frozen as the exchange moves to cover the losses.

Blockfront Editorial

2 min read

Binance says $6.3 billion stolen in hot-wallet hack

Binance said hackers compromised its hot wallets on Oct. 29, taking about $6.3 billion in token assets in what could be the largest crypto theft on record. In its latest incident update, the exchange said the breach occurred at about 20:05 UTC and it would cover the losses through its user protection fund and corporate treasury.

How did attackers get into Binance’s wallets?

Binance has not confirmed the full attack sequence. The company’s initial investigation pointed to a possibly compromised DevOps engineer’s laptop, which could have let an attacker access a service container and submit unauthorized withdrawals; a later update said investigators had found additional breach points.

Binance said it had found no evidence that wallet private keys were leaked. The Associated Press report also described the exchange’s initial account of the laptop and unauthorized withdrawals. The investigation is ongoing, and Binance said it plans to publish a technical postmortem after verifying its findings.

How much has been frozen, and who covers the losses?

Binance said about $3 billion of affected assets had been frozen on-chain through work with law enforcement, blockchain intelligence firms, token issuers and industry partners. It said it had set aside more than $6.34 billion to cover the losses, including $5 billion in the affected tokens, and was buying the remaining assets.

The exchange said users would not bear the financial impact. It temporarily suspended withdrawals while it checked and secured affected systems, while deposits and other unaffected services remained operational.

When will withdrawals resume?

Binance said it was aiming to begin restoring withdrawals in phases within about 34 hours of its Oct. 30 update, subject to security checks. It also planned an initial proof-of-reserves update by Nov. 2 and said it would continue working to recover frozen funds.

Sources and documents