Binance Suspends Withdrawals After $6.3B Wallet Breach

Binance suspended crypto withdrawals after attackers moved about $6.3 billion from its hot wallets, then announced a phased restart for Nov. 1. The company says it will cover the losses, while the scale of the theft makes it the largest crypto heist on record by dollar value.

In its second security incident update, Binance said the compromise occurred at about 20:05 UTC on Oct. 29. A hot wallet is connected to the internet and used to process transactions; Binance’s initial investigation suggested an attacker may have used a compromised DevOps engineer’s laptop to access a service container and submit unauthorized withdrawal transactions. The company later said investigators found additional points of breach. It reported no evidence that wallet private keys had been leaked.

What did Binance suspend after the breach?

Binance paused withdrawals while it checked and secured affected systems. Deposits and other unaffected platform services remained operational, according to the company. Its announcement describes a withdrawal suspension, not a halt to trading.

The distinction matters because a withdrawal moves crypto from an exchange account to an outside wallet, while a trade exchanges assets within the platform. Pausing withdrawals can limit the movement of funds while security teams investigate and revoke affected authorizations. Binance said it also worked with law enforcement, blockchain intelligence firms, asset issuers and other partners to trace and freeze funds.

The company estimated the loss at about $6.3 billion and said roughly $3 billion had been frozen on-chain. The Associated Press, citing blockchain intelligence firm TRM, reported that about $6.36 billion was moved from Binance wallets across ten blockchains, mostly within about 20 minutes. TRM attributed the attack to North Korea-linked group TraderTraitor; Binance said it was still working with law enforcement to identify those responsible.

How will users get access to withdrawals again?

Binance said it would restore withdrawals in phases after security and readiness checks. In its Nov. 1 recovery update, it said the first phase was planned for 06:00–09:00 UTC, with selected assets returning progressively across networks including Bitcoin, Ethereum, BNB Smart Chain, Tron and Solana.

That staged approach lets Binance check each network and asset as it restores access. The exchange said additional withdrawal options would return once ready, and warned users that traffic could cause delays during the rollout.

Who is covering the stolen funds?

Binance said it would absorb the losses through its Secure Asset Fund for Users, or SAFU, and company funds. It reported setting aside more than $6.34 billion, including $5 billion in the same token assets affected by the theft, and said it was buying the remaining assets. The company also said it planned to publish an updated proof-of-reserves snapshot after remediation. These are Binance’s commitments; its investigation into how the breach happened remained ongoing.

Sources

• second security incident update — binance.com
• Nov. 1 recovery update — binance.bh