Binance Hack: $6.3B Impact, $3B Frozen as Withdrawals Halt

The Binance hack investigation has revealed an estimated $6.3 billion security incident, with approximately $3 billion in affected assets frozen. The cryptocurrency exchange suspects attackers exploited a compromised employee laptop to submit unauthorized withdrawal transactions.

In an official October 30 announcement, Binance said it found no evidence that wallet private keys had leaked. The exchange pledged to cover customer losses through its Secure Asset Fund for Users (SAFU) and company funds.

Binance subsequently clarified that deposits continued operating normally. However, withdrawals remained suspended while its security team upgraded the withdrawal infrastructure. The company said it expected services to resume within 48 hours.

Binance Hack Investigation Points to Compromised Employee Laptop

Binance said its preliminary findings pointed to a compromised laptop belonging to a DevOps engineer. Investigators believe the device may have provided access to a service container.

The attacker allegedly used that access to submit unauthorized withdrawal transactions. However, Binance stressed that its investigation remained incomplete and the full attack path had not been established.

The exchange also said it had found no evidence of a private key leak. This distinction suggests the incident may have involved compromised operational systems rather than direct exposure of wallet credentials.

Binance revoked the affected address authorization as part of its immediate response. Its security team also began reviewing withdrawal services and associated addresses to prevent further unauthorized activity.

The company promised a detailed technical post-mortem after investigators verify the incident’s root cause. Law enforcement agencies and blockchain intelligence firms are assisting the investigation.

Binance Hack Losses Reach $6.3B as $3B in Assets Are Frozen

Binance estimated the incident’s total financial impact at approximately $6.3 billion. The figure substantially exceeds initial blockchain estimates of around $5.8 billion.

However, the exchange reported that approximately $3 billion in affected assets had already been frozen on-chain. These restrictions involved cooperation with blockchain networks, stablecoin issuers and industry partners.

Tether CEO Paolo Ardoino previously reported freezing over $1.567 billion in USDT associated with the incident. Circle CEO Jeremy Allaire also confirmed restrictions affecting more than $800 million in USDC.

Binance co-founder Yi He separately reported that the Arbitrum Security Council had frozen approximately $30.5 million linked to the attack.

These individual figures should not be added to Binance’s $3 billion total without confirmation that they represent separate amounts.

Meanwhile, blockchain analytics firm Chainalysis estimated that at least $5.912 billion had been stolen as of 00:30 UTC on October 30. The firm’s research head, Eric Jardine, said investigators identified movements across several blockchains.

The figures measure different aspects of the incident. Binance’s $6.3 billion represents its estimated impact, while the $3 billion figure covers restricted assets. Neither figure establishes how much money has been returned to Binance.

Binance Withdrawals Remain Suspended as Exchange Promises Compensation

Binance initially suspended both deposits and withdrawals while investigating the incident. Its subsequent service update clarified that deposits remained operational.

Withdrawals, however, remained paused while engineers reviewed the affected infrastructure. Binance said it expected to restore the service within 48 hours, although the timeline remained an estimate.

The exchange pledged to compensate affected customers using its SAFU emergency reserve and corporate funds. It also maintained that customer funds were safe.

Binance founder Changpeng Zhao said the incident appeared to be a hack and welcomed the response from stablecoin issuers. Zhao noted that he no longer manages Binance but remains a shareholder.

Coinbase CEO Brian Armstrong also offered assistance. In an October 30 statement, Armstrong said Coinbase was blocking transfers to compromised wallets and had contacted Binance.

The coordinated response reflects efforts to prevent attackers from moving funds through other cryptocurrency services.

Binance Hack Raises Questions About Exchange Reserves

The incident has also raised questions about the assets backing Binance customer balances.

A review of Binance’s October 1 Proof of Reserves identified an affected hot wallet among the exchange’s reported reserve addresses. The analysis suggested that some asset backing ratios could have declined after the unauthorized transfers.

However, the earlier reserve snapshot cannot establish Binance’s current backing position. The exchange said it would publish an updated Proof of Reserves after completing its remediation work.

That report could clarify how Binance has replaced affected assets and funded its compensation commitment.

The incident has also affected cryptocurrency markets. Bitcoin and other major tokens declined as investors assessed the potential financial and operational consequences.

For now, the main questions concern the final amount stolen, the recovery of restricted assets and the timeline for restoring withdrawals.

Binance said its teams would continue tracing the funds and working with authorities. The company has not announced a completed recovery or published its final investigation report.