Binance suspends withdrawals after $6.3B hot-wallet hack

Binance says attackers stole about $6.3 billion in tokens from its hot wallets on Oct. 29, prompting the exchange to suspend withdrawals while it checks its systems. The company says it will cover the stolen funds, and reported on Oct. 31 that it had replenished 90% of the affected assets.

A hot wallet holds crypto connected to the internet so an exchange can process withdrawals. Binance says its hot wallets were compromised at about 20:05 UTC. The exchange’s Oct. 30 security incident update says an initial investigation pointed to a compromised laptop, but later work found additional points of breach. Binance has found no evidence that wallet private keys were leaked. It says the full attack sequence remains under investigation.

What did Binance suspend after the breach?

Binance suspended withdrawals, not all platform activity. Deposits and other unaffected services remained operational, according to the exchange. A withdrawal is a transfer of tokens from a user’s exchange account to an external wallet. Binance says it paused those transfers while it reviews security, applies fixes and checks the affected systems’ integrity.

The distinction matters because the initial brief described trading as halted. Binance’s update does not say trading stopped. It says withdrawals were temporarily suspended, while deposits and other unaffected services continued. The withdrawal pause is a gate on moving funds off the platform, rather than a shutdown of the whole exchange.

How is Binance covering the stolen tokens?

Binance says it is using its Secure Asset Fund for Users, part of its Futures insurance fund and its corporate treasury to replace the stolen assets. In its Oct. 31 recovery update, the company said 90% of the affected amount was replenished. It said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed, and the remaining 10% consisted of less liquid tokens it was still sourcing.

Binance had said about $3 billion of affected assets were frozen on-chain, working with law enforcement, blockchain intelligence firms, asset issuers and industry partners. A freeze can block tokens from moving from identified addresses. It does not by itself return them to the exchange, so recovering frozen assets is separate from buying replacement tokens.

When will withdrawals resume?

Binance said it remained on track to reopen withdrawals on Sunday, Nov. 1, subject to security checks. The company also published a new proof-of-reserves snapshot dated Oct. 31. It said the full zero-knowledge proof, which users can use to verify that their balances are backed, was expected by Nov. 3. The breach investigation and asset recovery are ongoing.

Sources and documents

• Oct. 30 security incident update — binance.com
• recovery update — binance.com