Skip to the article
Onchain Brief

News from across crypto

Binance starts phased withdrawals after $6.3bn hack

Binance began reopening withdrawals in phases on Sunday after a security breach it puts at about $6.3 billion, while saying users will not bear the losses.

The Onchain Brief Editors2 min read
Binance starts phased withdrawals after $6.3bn hack

Binance began reopening withdrawals in phases on Sunday, three days after a security breach the exchange estimates caused about $6.3 billion in losses. The move gives customers access to some assets again, while security checks continue.

In its latest recovery update, Binance said the first phase would restore withdrawals for assets including Bitcoin, Ether, BNB, XRP and Dogecoin. It said the rollout began between 06:00 and 09:00 UTC on Nov. 1. Deposits remained open during the suspension.

What did Binance say caused the breach?

Binance’s initial investigation points to a compromised laptop belonging to a DevOps engineer, a role that helps maintain computer systems. The exchange said an attacker used access to a service container to submit unauthorised withdrawal transactions. It said it had found no evidence that wallet private keys were exposed.

Binance put the estimated impact at about $6.3 billion. It said it would cover the losses from its Secure Asset Fund for Users and company funds. The exchange also said it had worked with blockchain partners to freeze about $3 billion in assets. These are Binance’s estimates; its full technical account is still pending the investigation.

Which withdrawals are available, and what remains uncertain?

The first phase covered selected assets on networks including Bitcoin, Ethereum, BNB Smart Chain and Solana. Binance said it would restore other assets and networks after security and readiness checks. It warned that some withdrawals could take longer during the rollout.

Binance said it had replenished about 95% of the impacted amount by Nov. 1, with the remaining 5% made up of less liquid tokens. It said user balances in several major assets, including BTC, ETH, USDT and USDC, were fully backed. A post-incident report with more details is due after the investigation is complete.

The FBI said North Korea was responsible for the theft, according to CBS News’ report on the withdrawal resumption. The agency named TraderTraitor, a group it linked to the stolen assets. Binance’s announcement did not identify who carried out the attack. The FBI said it had seen the stolen assets being converted into Ethereum and urged companies to block transactions tied to the group’s addresses.

References