Binance uncovers wider breach in $6.3 billion exploit, targets Sunday withdrawal restart

Binance disclosed that it has replaced roughly 90% of the digital assets taken in a record‑breaking $6.3 billion hack, up from an earlier 80% estimate, and aims to resume customer withdrawals on Sunday, Nov. 1. The exchange says balances in major tokens such as Bitcoin, Ether, USDT, BNB and others are now fully backed, while the remaining 10% of thinner‑traded assets are being sourced in public and OTC markets. Binance will absorb the financial impact, drawing on more than $6.34 billion of corporate funds and its SAFU reserve.

Background

The breach, first reported on Oct. 28, involved a compromised DevOps engineer’s laptop that gave an attacker access to a service container and allowed unauthorized withdrawal transactions from Binance hot wallets across multiple blockchains. Within about 20 minutes the attacker moved assets worth roughly $6.36 billion, including 18,270 BTC, 167,464 ETH, 1.615 billion USDT and 233.46 million XRP, among dozens of other tokens. Approximately $3 billion of the stolen assets have been frozen on‑chain by entities such as Tether, Circle and the Arbitrum Security Council. Binance halted withdrawals on Oct. 29, kept deposits open, and began a security revamp of its withdrawal service. The exchange is cooperating with law‑enforcement agencies, including the FBI, and blockchain analytics firms. Independent firms TRM Labs, Chainalysis and Elliptic have linked the attack to North Korea’s elite hacking unit TraderTraitor with high confidence, noting similarities to prior North Korean‑linked heists. Binance’s co‑CEOs Richard Teng and Yi He have provided updates on the replacement effort, the use of over‑the‑counter trades for altcoins, and the upcoming proof‑of‑reserves report scheduled for early November.

What happened

Binance first announced that a security incident had impacted about $6.3 billion of assets, initially pointing to a compromised engineer’s laptop (source 4). Subsequent investigation uncovered additional breach points and revealed that the attacker used an EIP‑7702 delegation to gain execution authority over a hot wallet, bypassing normal approval controls (source 3). The attacker submitted a single transaction containing 50 pre‑signed authorizations, allowing one to execute when the wallet’s nonce matched, which moved 167,464 ETH, 1.615 billion USDT and other tokens (source 4). Within minutes, Binance hot wallets on XRP Ledger, Solana, Optimism, Ethereum, Bitcoin and Tron transferred large sums to the attacker’s address (source 2). The attacker also deposited 60 million USDT on Aave and borrowed Ether against it before Tether and Circle froze the stablecoin balances (source 2). Binance froze withdrawals at 22:15 UTC on Oct. 29 and began a security revamp (source 2). By Oct. 30 the exchange reported that it had replaced 90% of the stolen assets, with balances in Bitcoin, Ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC fully backed (source 1). The remaining 10% of thinner‑traded tokens are being sourced publicly and via OTC deals, with about $3 billion of frozen assets still on‑chain (source 1). Binance pledged to cover all losses using its SAFU fund and corporate treasury, tapping more than $6.34 billion, including $5 billion already held in the exact tokens stolen (source 1). The exchange plans to resume withdrawals within 40‑48 hours, targeting a Sunday, Nov. 1 restart, and will publish a full proof‑of‑reserves report by Nov. 3 (source 1, 2, 3).

Market impact

The hack displaced assets worth $6.3 billion, making it the largest crypto theft on record, surpassing the $1.46 billion Bybit hack of 2025. Approximately $3 billion of the stolen funds have been frozen, including 1.567 billion USDT by Tether and 800 million USDC by Circle, as well as $30.5 million by the Arbitrum Security Council (source 4). Binance’s replacement effort has restored full backing for major tokens, with a proof‑of‑reserves snapshot taken at midnight UTC on Oct. 31 showing coverage ratios of 100% or more (source 1). The exchange has earmarked over $6.34 billion in corporate funds to cover the loss, drawing from its SAFU reserve, futures insurance, and corporate treasury, and plans to rebuild the SAFU reserve to about $1 billion (source 1). The incident prompted Aave to temporarily freeze new deposits and borrowing before reopening markets, and caused a brief suspension of Binance withdrawals while the security revamp was completed (source 2). The ongoing attribution to North Korea’s TraderTraitor group has heightened geopolitical scrutiny of crypto flows used to fund illicit activities.

Why it matters

The breach highlights systemic risks in centralized exchange custody, especially the vulnerability of a single credential to access hot wallets holding customer assets. Analysts cited weak approval controls and the misuse of EIP‑7702 as factors that allowed the attacker to bypass normal safeguards (source 3). Binance’s decision to absorb the loss on its books, rather than passing it to users, underscores the importance of robust emergency reserves like SAFU, yet the scale of the incident tests the adequacy of such mechanisms. The attribution to a state‑linked hacking unit raises concerns about the use of stolen crypto to fund sanctioned regimes, potentially prompting tighter regulatory scrutiny of exchanges and cross‑border crypto flows. The rapid freezing of assets by stablecoin issuers and the involvement of law‑enforcement agencies illustrate growing coordination between the crypto industry and authorities in response to large‑scale thefts. Finally, the upcoming proof‑of‑reserves report will set a benchmark for transparency and could influence industry standards for asset backing and user protection.