Binance paused withdrawals after $6.3bn hot-wallet breach

Binance says attackers stole about $6.3 billion from its hot wallets on Oct. 29, prompting the exchange to suspend withdrawals while it contained the breach and worked to recover funds. The company said it would cover the loss. Its public updates describe a withdrawal pause; they do not confirm that trading was halted.

In its technical incident report, Binance said the attack used unauthorized access to an internal wallet-signing service. That service authorizes transactions from hot wallets, which are connected to the internet and used to move crypto. Binance said the attackers used it to send assets outside the normal withdrawal process.

How did the attackers move funds out of Binance?

They first gained access to the signing service, then used it to authorize transfers from Binance hot wallets. Between 20:05 and 20:09 UTC on Oct. 29, five wallets sent 233.46 million XRP to an attacker-controlled address, Binance reported. Hot wallets on Solana and Optimism then sent about 970,500 SOL and 44.2 million OP. A Binance hot wallet also sent 18,270 bitcoin.

On Ethereum, the attackers used EIP-7702, a protocol feature that lets an account delegate some execution rights to a smart contract without revealing its private key. Binance said the attackers used it to give their own contract partial execution rights over a hot wallet. The resulting on-chain permissions could keep moving assets even after Binance suspended withdrawals. It was like disabling the usual exit while a separate authorization remained active.

Why did pausing withdrawals not stop the transfers?

Suspending withdrawals restricted the normal route for users to move funds, but it did not erase permissions already recorded on-chain. Binance said its hot wallet used multi-party computation, or MPC, which distributes signing authority rather than keeping one private key in one place. That meant the company needed a specialized procedure to revoke the malicious authorizations. Binance said the final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC. At 00:10 UTC on Oct. 30, it cleared the delegation code.

The exchange reported that it froze $2.85 billion in assets and temporarily suspended withdrawals while it checked affected systems. Deposits and other unaffected services remained operational, according to its incident update. The Associated Press account of the breach described the theft as the largest crypto heist on record and reported that blockchain firms suspected a North Korean hacking unit.

Who will cover the stolen crypto?

Binance said it would absorb the financial impact through its Secure Asset Fund for Users and corporate treasury. In its Oct. 30 update, it said it had set aside more than $6.34 billion, including $5 billion in the affected tokens, and was working with law enforcement, blockchain firms and token issuers to trace and freeze funds. Those are Binance’s stated commitments and recovery figures; the investigation into how access was obtained remained ongoing.

Sources and documents

• technical incident report — binance.com
• Associated Press account of the breach — apnews.com