Skip to main content
Blockfront

Crypto markets, protocols and policy

Binance says hot-wallet breach cost $6.3 billion

Binance says attackers took about $6.3 billion from hot wallets, with withdrawals returning in phases and the exchange covering losses as its investigation continues.

Blockfront Editorial

2 min read

Binance says hot-wallet breach cost $6.3 billion

Binance says an attacker stole about $6.3 billion in token assets from its hot wallets on Oct. 29, and the exchange is replenishing affected assets while restoring withdrawals in phases. The company’s Nov. 1 update said it had covered about 95% of the impacted amount; the Associated Press report also cited Binance’s estimate of roughly $3 billion frozen on-chain.

How did the attacker get access?

Binance said the incident involved unauthorized withdrawals from hot wallets, which hold crypto assets connected to online services. Its initial investigation pointed to a potentially compromised laptop, but the company later said investigators had found additional points of breach and were still establishing the full attack sequence.

Binance said it had found no evidence that wallet private keys were leaked. The exchange has not published a completed technical account of the incident.

How much of the loss has Binance covered?

Binance said it would absorb the financial impact and cover the stolen funds through its Secure Asset Fund for Users and corporate treasury. In its Nov. 1 recovery update, it said roughly 95% of the affected amount had been covered, with the remaining 5% consisting of less liquid tokens it was still sourcing.

The exchange also said blockchain partners had frozen about $3 billion on-chain. Binance said it was working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover assets.

When will withdrawals return?

Binance said it planned to begin restoring withdrawals in phases on Nov. 1, after security checks on affected services. Deposits remained open, and the company said additional networks and assets would become available as checks were completed.

Binance said it would publish a post-incident report after its investigation is complete. It has not yet provided a final technical account of how the breach unfolded.

Sources and documents