Binance says $6.3B stolen in record crypto hack

Binance says attackers stole about $6.3 billion from its hot wallets on Oct. 29, in what may be the largest crypto theft on record. The exchange has paused withdrawals while it checks its systems and works to cover user losses.

In its Oct. 30 security update, Binance said the unauthorized withdrawals began around 20:05 UTC. Deposits and other unaffected platform services remain operational, the exchange said; it did not announce a halt to all trading.

How did attackers take the funds?

They withdrew tokens from Binance hot wallets, which are connected to the internet, the company said. The exchange has not published a full account of how the attackers got in.

Binance’s initial investigation pointed to a potentially compromised laptop, but the company said it later found additional points of breach. It said it has found no evidence that wallet private keys were leaked. The investigation is ongoing.

The Associated Press reported that blockchain intelligence firm TRM traced about $6.36 billion in assets across ten blockchains and attributed the attack to TraderTraitor, a North Korean hacking unit. TRM said the funds moved in about 20 minutes. That attribution is an assessment by the firm, not a confirmed finding by Binance or law enforcement.

Will customers bear the losses?

Binance says it will cover the stolen funds through its Secure Asset Fund for Users and company treasury. It has set aside more than $6.34 billion, including $5 billion in the same token assets that were taken, and says it is buying the remaining amount.

The exchange also said it worked with law enforcement, blockchain firms, token issuers and other partners to freeze about $3 billion on-chain. Binance says those frozen funds are separate from the money it has set aside to cover the loss. Recovery efforts are continuing.

The size of the theft makes the response consequential for users watching whether Binance can restore withdrawals and show that account balances remain backed. The company has said user funds will not be used to absorb the loss.

When could withdrawals resume?

Binance is temporarily suspending withdrawals as it completes security reviews and fixes affected systems. Its Oct. 30 update said it was targeting a phased restart in about 34 hours, subject to those checks.

The exchange also plans to publish a Proof of Reserves snapshot, with results expected by Monday, Nov. 2, and said further technical findings could come in about 48 hours. Watch for the withdrawal restart and the reserve snapshot to see what Binance can verify about its recovery.

Source material

• Oct. 30 security update — binance.com