What is known so far
Binance said that its hot wallets were compromised at about 20:05 UTC on 29 October, resulting in unauthorized token withdrawals worth roughly $6.3 billion. The company revoked affected authorizations, strengthened infrastructure controls and began tracing the assets with partners.
An early suggestion involving a compromised DevOps engineer laptop is not a final technical finding. In a subsequent update, Binance said it had identified additional possible breach points and would publish a full account only after verifying the facts. The company said it had found no evidence of leaked wallet private keys.
How Binance says losses will be covered
Binance said the financial impact would not be passed to users, naming the SAFU fund and company funds as the coverage sources. In its second update, the exchange said it had set aside more than $6.34 billion, including about $5 billion in the same asset types affected by the incident.
The platform also reported freezing about $3 billion in related on-chain assets. A freeze and a reserve allocation do not mean the investigation or full recovery is complete; both the amounts and recovery process may change as transactions are reviewed.
Withdrawals and proof of reserves
Crypto withdrawals were paused temporarily, while Binance said deposits and some other services continued to operate. The exchange later announced a phased resumption of withdrawals following additional security checks.
Binance also committed to an updated Proof of Reserves. Such a snapshot can provide an additional view of stated platform assets and liabilities at a specific time, but it does not replace an investigation into the incident or an independent assessment of security controls.
Investigation and user safety
On 31 October, the FBI said it attributed the theft of more than $6 billion to North Korean malicious cyber activity it calls TraderTraitor. The bureau said it had observed conversion of some assets into Ethereum and urged relevant industry participants to block transactions involving the identified addresses. That is an investigative attribution; the technical attack sequence remains under examination.
Incidents like this attract fake compensation, account-restoration and urgent-withdrawal messages. Never enter a seed phrase, private key, 2FA code or password on a site sent in a message. Check account status and instructions only through Binance's official website and app.
- Binance's confirmed impact estimate is about $6.3 billion.
- The exchange said SAFU and corporate funds will cover losses.
- Crypto withdrawals are being restored in phases after checks.
- Ignore compensation offers from unofficial channels.
