$6.34 billion affected by Binance hack; company says it has replaced 98%
Key Facts
Binance said digital assets worth about $6.34 billion were affected by a security incident on October 29, in an update focused on the scale of losses and the platform’s ability to contain them. The company said 98% of the affected assets had been replaced by October 31 and that it was working to buy the remaining less-liquid assets. In its update, it said it had already set aside more than 100% of the funds needed to cover losses and would bear the financial impact of the incident. It also said about $2.85 billion in assets had been frozen or intercepted as of its November 3 update. The value of frozen or intercepted assets was subject to reconciliation and price fluctuations, according to the company.
Binance said the attacker exploited unauthorized access to an internal wallet-signing service, then made transfers outside the normal withdrawal process. It said five hot wallets sent 233.46 million XRP to an address controlled by the attacker between 20:05 and 20:09 UTC on October 29. It added that a hot wallet sent 18,270 BTC to the same address. These transfers are central to the company’s account of how the incident was carried out, with an internal service used to initiate transactions that did not go through the usual withdrawal procedures. Binance said the latest information from the Federal Bureau of Investigation attributes responsibility for the incident to North Korea.
In an independent assessment of the asset flows, the Associated Press cited TRM as saying the attacker moved about $6.36 billion from Binance wallets across ten networks, with most transfers made over about 20 minutes. That figure differs from Binance’s estimate of $6.34 billion in assets affected by the incident, and the description of assets as “moved” differs from saying they were “affected.” Binance said about $2.85 billion had been frozen or intercepted, while announcing that it had replaced 98% of affected assets by October 31. The three figures do not mean the same thing: affected assets cover the scope of the incident as defined by the company; frozen or intercepted assets were halted or intercepted; and replaced assets are those the platform said it had compensated for or bought. The recovery rate remains tied to Binance’s classification of affected assets, while the value of intercepted assets is subject to reconciliation and price fluctuations.
Customer and price movements in the following days showed that the incident prompted a market response, but the available figures relate to sessions before November 4. According to Reuters, Bitcoin fell on October 29 to a six-week low of $76,368, while Ethereum dropped more than 3% to a two-month low of $2,178, before markets stabilized. When Binance services resumed, customers withdrew $3.64 billion, equivalent to 2.1% of the platform’s assets, through November 2, according to Reuters. The agency said Ethereum hit a two-month low on Friday, then recovered slightly to $2,287 on November 2. These figures document the October 29 and November 2 sessions and do not specify Bitcoin’s or Ethereum’s prices in the November 4 session.
The Binance hack follows another major incident at a cryptocurrency exchange. The Associated Press reported that Bybit suffered a $1.5 billion theft in February of the previous year, and the FBI then attributed the attack to North Korea and the “TraderTraitor” group. At the start of the current investigation, Binance said deposits and withdrawals were temporarily suspended to conduct security checks, freeze funds and work with law enforcement. The FBI asked cryptocurrency platforms, blockchain analytics firms and others to block transactions linked to specific addresses to prevent laundering of the stolen assets, according to the Associated Press. Binance said it was engaging independent cybersecurity experts to conduct a comprehensive review of the incident, verify the findings and recommend additional measures. The review remains a next step announced by the company, while the compensation, recovery and freezing figures are based on its updates through November 3.