Binance pauses withdrawals after a security incident it puts at around $6.3bn, and says it will cover all losses

Update, 30 October, 12:40pm GMT

In an investigation update on X at 8:47am GMT, Binance said: “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.” The exchange no longer attributes the incident only to a single compromised laptop, which was the explanation in its 2:23am announcement. It did not say what the additional points of breach were. It called it “a complex attack” and said: “We are still gathering the facts, and will share more directly as we have them.”

The same post said: “We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected.” This replaces the 48-hour expectation in Binance’s 4:36am post. By our calculation, counting from each post, the new estimate points to 5:47am GMT on Sunday 1 November, against 4:36am GMT for the earlier one. Binance has not given a clock time. It repeated that it “will cover all losses from the SAFU fund and the company’s funds” and said it had “frozen around $3 billion thus far”. It added: “The outflows ceased when we paused withdrawal service earlier.”

At 10:55am GMT, Binance said it “has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted.” It said it is “completing the purchase of the remaining amount by buying token assets through market channels and OTC channels”, to “match the format of the remaining token assets and address any asset shortfalls”. It warned: “This step can take longer because some tokens may have low liquidity and OTC settlement also takes time.”

Binance said the reserved figures “do not include frozen or protected assets, which remain subject to ongoing recovery and verification”, and that “$3bn has been frozen”. It said it “has begun recovering affected assets for users”. It added: “Ultimately, all user funds will be verified publicly through our Proof of Reserves.” As of 12:40pm GMT, Binance has not published its technical post-mortem or announced that withdrawals have resumed.

What Binance has said

In a Security Incident Update published at 2:23am GMT on 30 October, Binance said its “initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” It added: “We have found no evidence of any wallet private key leak.”

The exchange said: “The estimated total impact sits at around $6.3B.” It said it had worked with blockchain partners to freeze affected assets, with ”~$3 billion frozen on-chain so far”. It also said: “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.” Binance said it would publish a detailed technical post-mortem and “an updated Proof of Reserves once the remediation is complete”.

As immediate precautions, the announcement said Binance had “temporarily suspended deposits and withdrawals while security checks are completed”, “revoked the affected address authorisation” and “engaged law enforcement and blockchain intelligence partners to trace and recover funds.”

How the response unfolded

Binance’s first public statement, on X at 9:15pm GMT on 29 October (edited until 9:29pm), said its teams were “aware of reports of a potential security issue and are actively investigating” (Binance). At 11:06pm GMT it said Binance Alpha trading had been “temporarily suspended” (Binance).

At 11:22pm GMT Binance said “the current verified total frozen is $2.54 billion”, responding to “differing figures circulating publicly” (Binance). At 12:13am GMT on 30 October it said “all deposits and withdrawals are temporarily suspended” and that it “will cover all losses” (Binance). At 12:52am GMT it put the “verified total frozen amount” at “around $3 billion” (Binance).

In a later Service Update at 4:36am GMT, Binance said: “Deposits remain unaffected and continue to operate as normal.” That differs from its 12:13am post and its 2:23am announcement, which both said deposits had been suspended. Binance has not explained the change. It said withdrawals “remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours.” It added that “the incident stems from multiple factors” and that its security team is “tracing the full attack path through the compromised computer which may be the entry point of the incident.”

Stablecoin issuers and Binance.US

Tether chief executive Paolo Ardoino posted at 9:25pm GMT on 29 October that “Tether froze more than 1.567B USDT related to a potential Binance exchange hack” (X). Circle chief executive Jeremy Allaire posted at 9:18pm GMT that, “In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident” (X).

Binance.US said at 9:41pm GMT that it “is not affected by the reported Binance.com security incident”, describing itself as “a separate, independent platform”.

What blockchain analysts say

Blockchain analytics firm TRM Labs, in a blog post dated 29 October, put the outflows at approximately USD 6.36 billion across ten blockchains. It said most of the funds moved in about 20 minutes from 8:05pm GMT. TRM said it “attributes the attack to TraderTraitor, North Korea’s elite hacking unit”, a judgement it says it makes “with high confidence”. TRM called it “the largest crypto theft on record”. These are TRM’s assessments. Binance has not attributed the attack, and it has not yet published a root cause.

TRM’s own reading of the on-chain evidence is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains. Binance initially described the entry point as a compromised laptop and said it found no evidence of a private key leak. It now says it has found additional points of breach. The two accounts are not necessarily in conflict, but the full picture awaits Binance’s post-mortem.

Why it matters

Custody and operational risk. On Binance’s account, the failure was in the operational systems around withdrawals, an engineer’s machine and a service container, rather than in leaked keys. For market practitioners, that moves the due-diligence questions from key storage to access controls, transaction approval and how far one compromised endpoint can reach. A promise to cover losses protects balances, but it does not cover the time assets can’t be moved. Firms using a venue for collateral or settlement need to plan for withdrawal pauses that last days.

Stablecoin issuer freezes. On Tether’s and Circle’s own figures, the two issuers froze more than $2.3bn of USDT and USDC within hours. That put those funds out of the attacker’s reach, but it also shows that fiat-backed tokens carry an issuer-side control that can act on any wallet. Desks that hold or settle in these tokens should treat freeze capability as part of the instrument’s risk profile: it can protect holders, and it can also be used against any wallet.

Tokenisation and 24/7 venues. The first outflows, as TRM describes them, came at 8:05pm GMT on a Thursday, and the response ran through the night. Always-on venues and tokenised settlement need incident response, issuer contacts and the ability to halt processes around the clock. They also need a clear decision on who can pause what. The episode does not show that tokenised markets are unsafe, but it is a live test of the controls that 24/7 venue proposals will be judged on.

What we are watching

• Binance’s technical post-mortem and root cause, and its updated Proof of Reserves.
• Whether withdrawals resume within the 45 hours Binance indicated at 8:47am GMT on 30 October, and on which networks first.
• How far Binance has got in buying the remaining token assets through market and OTC channels, and what the additional points of breach were.
• Any revision to the “around $6.3B” impact and ”~$3 billion” frozen figures.
• Statements from law enforcement or regulators on the attribution.