Binance Wallet Breach Costs It About $6.3 Billion
Key Facts
Binance said its hot wallets were breached at about 20:05 UTC on Oct. 29, resulting in the loss of tokenized assets estimated at about $6.3 billion. The platform announced that it would cover the stolen funds through its Secure Asset Fund for Users (SAFU) and company treasury. The announcement came as Bitcoin fell 3.2% to below $79,000 on Thursday evening, according to the Associated Press. Binance said its response includes allocating company funds and temporarily suspending withdrawals during security reviews. The scale of the loss puts the attack at the center of attention on platform security and the continuity of its services.
Binance said in an update on Oct. 30 that it had allocated more than $6.34 billion in company funds to cover the impact, including $5 billion held in the same affected tokenized assets, such as USDC, USDT, BTC, ETH and BNB. The platform estimated that the allocated funds cover about 80% of the affected amount. It said the losses would be covered through SAFU and the company treasury, while the update clarifies that the $6.34 billion is company money allocated for the response. Binance did not describe this amount as a separate emergency fund. Allocating assets that match the stolen tokens means a large part of the response is based on holdings in the same categories affected by the theft.
Binance said about $3 billion of the affected assets had been frozen on-chain as of its Oct. 30 update, and that recovery efforts would continue. The platform temporarily suspended withdrawals but said deposits and other unaffected services remained operational. The technical team aimed to begin gradually resuming withdrawals within about 34 hours of its update, subject to completion of security checks. The company said the resumption of service would depend on the outcome of those checks. Binance also announced that it would take an initial proof-of-reserves snapshot within 12 hours, with results ready by Monday, Nov. 2, 2026.
Binance said its initial investigation pointed to a possible link to a compromised laptop, but that a subsequent investigation uncovered additional breach points. It added that it had found no evidence of private wallet keys being leaked. Reuters quoted a source familiar with the matter as saying Binance was working with law enforcement agencies around the world, including the Federal Bureau of Investigation and the U.S. Secret Service. The news agency said the cooperation follows the theft of assets worth $6.3 billion from the platform. The initial findings and announced cooperation reflect two parallel investigative tracks: identifying the breach points and coordinating with authorities.
Reuters reported that most of the theft took place over about 20 minutes, starting shortly after 20:00 GMT on Thursday, according to blockchain records. In identifying the perpetrators, TRM Labs attributed the attack to North Korea's TraderTraitor unit, as reported by the Associated Press. The company said it made this assessment "with high confidence." The assessment remains attributed to the blockchain analytics company, as reported by the news agency. The available information did not include an announcement from Binance confirming the attribution to that unit.
Binance said it expected to publish additional technical findings within about 48 hours of its Oct. 30 update, after verification and provided disclosure would not harm the ongoing investigation. It also pledged to issue a detailed technical report covering what happened, lessons learned and additional safeguards it would implement. In addition, the company set a deadline of Nov. 2, 2026, for publishing the results of its proof-of-reserves snapshot. The gradual resumption of withdrawals will remain subject to completion of security checks, under the framework announced by the platform. These deadlines place the investigation's findings, the reserves review and restoration of service among Binance's announced next steps.