Binance says it will cover $6.3 billion stolen in wallet breach

Binance says attackers took about $6.3 billion from its hot wallets on Oct. 29, and the exchange will cover the loss so customers do not bear it. A hot wallet is crypto storage connected to the internet. In its Oct. 30 security update, Binance said it had set aside more than $6.34 billion in company funds, including $5 billion in the same tokens that were stolen.

Binance said the breach involved unauthorized withdrawals from its hot wallets at about 20:05 UTC. The company has not released a full account of how the attack worked. Its initial investigation pointed to a possibly compromised laptop, but it later found additional points of breach. Binance said it had found no evidence that wallet private keys were leaked.

How much of the stolen crypto has been frozen?

Blockchain analytics firm Elliptic said it had verified $2.84 billion in frozen funds, about 44% of the theft, in its Oct. 30 analysis. Binance put the amount frozen on-chain at about $3 billion. Most frozen funds were USDT and USDC, two stablecoins—tokens designed to track the value of a currency such as the U.S. dollar.

Elliptic estimated that $6.43 billion in crypto was taken across 11 blockchains. That estimate is slightly higher than Binance’s roughly $6.3 billion figure. Elliptic said the attacker was moving some of the remaining assets between blockchains. Its figures reflect its analysis at the time of publication, and the investigation was still developing.

Will users be able to withdraw their money?

Binance temporarily suspended withdrawals while it reviewed and secured affected systems. The company said deposits and other unaffected services remained available, and it planned to resume withdrawals in phases after security checks. Its Oct. 30 update set a target of about 34 hours, subject to those checks.

Binance said it would use its Secure Asset Fund for Users, known as SAFU, and company funds to cover the stolen assets. It had reserved more than $6.34 billion and was buying the remaining affected tokens, the company said. It also planned to publish a new proof-of-reserves snapshot by Nov. 2. A proof-of-reserves report shows assets held by a platform and how they back customer balances.

The company said it was working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover funds. Elliptic said North Korea-linked actors were a likely lead, but no government or law enforcement agency had confirmed who was responsible.

References

• Oct. 30 security update — binance.com
• Oct. 30 analysis — elliptic.co