Binance reports $6.3B security breach, freezes $3B

Binance says attackers withdrew about $6.3 billion in cryptocurrency after gaining access to a service container, and the exchange says partners have frozen about $3 billion of the affected assets. In its security incident update dated October 30, Binance said it would cover losses with its Secure Asset Fund for Users and corporate funds. The Associated Press reported the theft and Binance’s recovery efforts the following day.

How could a laptop lead to unauthorized withdrawals?

Binance’s preliminary investigation points to a compromised laptop belonging to a DevOps engineer. The company said an attacker may have used it to access a service container and submit withdrawal transactions without authorization. A service container is a software environment used to run parts of an exchange’s systems; it is a step in the chain between an internal service and the action it can take.

The laptop is a possible entry point, not a complete account of the breach. Binance later said its investigation had uncovered additional points of breach. It said it had found no evidence that wallet private keys were compromised, and promised a technical post-mortem after the facts are verified.

Which wallets were affected, and what is frozen?

Binance’s co-CEO Richard Teng said the exchange’s hot wallet was affected. Hot wallets are connected to the internet so they can process withdrawals; Binance says most user assets are kept in cold wallets, which stay offline and are moved into hot wallets when withdrawals are needed. The distinction helps explain why an incident involving a hot wallet does not, by itself, establish that all customer assets were exposed.

Blockchain intelligence firm TRM told AP that about $6.36 billion moved from Binance wallets across ten blockchains, mostly within about 20 minutes. Binance said it had worked with blockchain partners to freeze roughly $3 billion on-chain. The company temporarily suspended withdrawals while conducting security checks, and said it had revoked authorization for affected addresses and was working with law enforcement and blockchain intelligence partners to trace the funds.

Who is covering the losses?

Binance says it will cover all losses through its Secure Asset Fund for Users, known as SAFU, and company funds. AP reported that Binance had reserved more than $6.34 billion for that purpose. The exchange also said it would publish an updated proof of reserves after remediation is complete. That report is intended to show assets held against customer balances; it will follow the recovery work, rather than explain the breach itself.

The key unresolved question is how the attacker gained access and whether more funds can be recovered. Binance has not yet published its full technical account. Until it does, the laptop and service-container route remains a preliminary explanation, while the company’s stated impact and freeze totals describe the scale of the response so far.

Sources and documents

• security incident update dated October 30 — binance.com
• reported the theft and Binance’s recovery efforts — apnews.com