Binance says hot-wallet breach cost $6.3 billion

Binance said hackers stole about $6.3 billion from its hot wallets on Oct. 29, in what could be the largest cryptocurrency theft on record, according to Associated Press reporting. The exchange said it would cover the losses and that roughly $3 billion in affected assets had been frozen on-chain.

The theft came through unauthorized withdrawals from Binance’s hot wallets, which hold crypto assets for transactions. Binance’s preliminary investigation suggested a DevOps engineer’s compromised laptop may have let an attacker access a service container and submit the withdrawals, the exchange said in its security incident update.

How did the attacker get access to Binance’s wallets?

Binance said it had found no evidence that wallet private keys were leaked. It has not published a full technical account; the exchange said it would release a post-mortem after the investigation and verification of the facts are complete.

The exchange said it contained the compromised infrastructure, revoked affected authorizations and worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze funds. Binance put the amount frozen on-chain at about $3 billion in its Oct. 30 update.

Who will cover the stolen funds?

Binance said it would absorb the financial impact through its Secure Asset Fund for Users and corporate funds. In a follow-up update, it said it had set aside more than $6.34 billion, including $5 billion in the same token assets that were stolen.

What happens next in the investigation?

Binance said it was continuing security checks and efforts to recover assets. It said it would publish an updated proof-of-reserves report after remediation and a technical post-mortem once the investigation is complete.

Sources and documents

• Associated Press reporting — apnews.com
• security incident update — binance.com