Binance says hot-wallet breach caused $6.3 billion loss
Binance says attackers took about $6.3 billion from its hot wallets, prompting a withdrawal halt as it secures systems and works to recover assets.
The Chain Times Desk2 min read
Binance said attackers made unauthorized withdrawals from its hot wallets, causing an estimated $6.3 billion loss and a temporary halt to withdrawals. The exchange’s Oct. 30 security update says the breach happened around 20:05 UTC on Oct. 29. Hot wallets are connected to the internet and used to move crypto. The loss makes this a major security incident for the exchange and its users.
The Associated Press reported Binance’s initial response: the company was investigating a potential security issue and had not yet confirmed stolen funds. Its later update said hot wallets were compromised and unauthorized withdrawals caused the loss.
How did the attackers get access?
Binance has not yet published a full account of the attack. Its initial investigation suggested a compromised laptop may have let an attacker access a service container and submit unauthorized withdrawals. A service container is a software environment used to run part of a system.
In its Oct. 30 update, Binance said its investigation had uncovered additional breach points. The company said it had found no evidence that wallet private keys were leaked. It said it would share technical findings after verifying them and when doing so would not harm the investigation.
What is Binance doing about the loss?
Binance says it will cover the stolen funds through its Secure Asset Fund for Users and company funds. The exchange said it had set aside more than $6.34 billion, including $5 billion in the affected tokens. It said about $3 billion had been frozen on-chain through work with law enforcement, blockchain intelligence firms, token issuers and industry partners. Frozen assets are blocked from moving, but that does not mean they have been returned to Binance.
The exchange temporarily suspended withdrawals while it checked and secured affected systems. Binance said deposits and other unaffected services remained available. It also said it was working to restore withdrawals in phases and planned to publish a technical report after its security review. The investigation was still ongoing in the company’s Oct. 30 update, so the full attack method and how much of the frozen crypto can be recovered remain unclear.
Sources and documents
- Oct. 30 security update — binance.com
- reported Binance’s initial response — apnews.com