Binance reports $6.3bn theft in record crypto breach

Binance says attackers stole about $6.3 billion from its hot wallets, the exchange’s internet-connected crypto storage, in a breach it called one of the largest on record. In its security incident update, Binance said the theft happened around 20:05 UTC on Oct. 29 and that it would cover the losses.

The exchange temporarily suspended withdrawals while it ran security checks. It said deposits were still operating normally. Reuters reported on Oct. 30 that Binance was targeting a return of withdrawal services within about 34 hours; that was a target, not confirmation that withdrawals had resumed.

How did attackers get into Binance’s wallets?

Binance’s initial investigation suggested that an attacker may have used a compromised laptop belonging to a DevOps engineer to access a service container and submit unauthorized withdrawals. The company said it found no evidence that wallet private keys had leaked, and promised a fuller technical account after the investigation.

Binance later described the incident as involving compromised hot wallets. It said about $3 billion of affected assets had been frozen with help from blockchain partners. The remaining amount had not been accounted for in the company’s update. The exchange said it was working with law enforcement and blockchain intelligence firms to trace and recover funds.

Will customers bear the losses?

Binance said it would cover all losses using its Secure Asset Fund for Users, or SAFU, and company funds. Reuters reported Binance’s response and recovery plans, including that the company had set aside about $6.34 billion to cover losses. Binance said customer funds were safe.

The breach also drew scrutiny over who was responsible. Blockchain analysis firm TRM Labs attributed the attack to TraderTraitor, a North Korean hacking unit, according to the Associated Press. Binance said it was working with law enforcement to confirm the criminals’ identities. The attribution remains an assessment by outside researchers, not a conclusion Binance announced.

The size of the reported loss makes the incident a major test of the exchange’s recovery plan and security controls. Binance said it would publish an updated proof-of-reserves snapshot after remediation. Its investigation was still underway, so the precise path of the attack and the final amount recovered remained unsettled.

Sources and documents

• security incident update — binance.com
• reported Binance’s response and recovery plans — ca.investing.com