Hackers steal $6.3 billion from Binance wallets

Hackers stole about $6.3 billion in crypto from Binance wallets on Oct. 29, in a breach that the exchange says it will cover without passing the loss to users. The theft affected wallets across several blockchain networks and triggered a temporary halt to withdrawals.

In its Oct. 30 security update, Binance said the breach began around 20:05 UTC and involved unauthorized withdrawals from its hot wallets. These are internet-connected wallets exchanges use to process transactions. Binance said its initial investigation pointed to a compromised laptop, but later uncovered additional points of breach. It has not published the full cause.

How much crypto was taken, and where?

Blockchain intelligence firm TRM Labs estimates that about $6.36 billion in crypto left Binance wallets across ten blockchains. Most of the funds moved in roughly 20 minutes. TRM’s estimate values the assets when they were taken; their value later changed with market prices.

TRM said the attack likely came from TraderTraitor, a hacking group it links to North Korea. The company based that assessment on on-chain and off-chain intelligence. Binance has not publicly named a suspected attacker, and the exchange’s investigation is still underway.

Will users bear the loss?

Binance says it will absorb the loss through its user protection fund and company treasury. It reported setting aside more than $6.34 billion, including $5 billion in the same types of tokens that were stolen. The company said it was buying the remaining assets.

Binance also said about $3 billion had been frozen on-chain through work with law enforcement, blockchain investigators, token issuers and other industry partners. A freeze can stop certain tokens from moving when their issuers or network operators have that power. It does not recover every stolen asset.

What remains unknown?

Binance has not explained the full attack sequence or identified all the points of breach. The company said it found no evidence that wallet private keys had leaked, but said the investigation continues. TRM’s analysis points to a compromise of the system used to authorize transactions across the exchange’s wallets; that remains the firm’s assessment, not a confirmed finding from Binance.

Binance temporarily suspended withdrawals while it checked and secured affected systems. It said deposits and other unaffected services remained available, and it planned to restore withdrawals in stages after security checks. The company said it would publish technical findings and an updated proof of reserves, a report users can use to check the assets backing account balances.

References

• Oct. 30 security update — binance.com
• TRM Labs estimates — trmlabs.com