Image credit: Shutterstock
- Binance suffered a $6.3 billion security breach on October 30 via unauthorized withdrawals.
- Partners successfully froze roughly $3 billion of the stolen crypto assets during recovery efforts.
- Binance committed to covering all unrecovered losses using its SAFU and company funds.
Binance estimated $6.3 billion security breach on Oct. 30, the largest crypto hack recorded, and pledged to cover all losses. A subsequent update stated that the deposits were operating normally, while withdrawals remained paused.
Compromised Laptop Linked to Unauthorized Withdrawals
Binance’s preliminary investigation suggested that a compromised DevOps engineer’s laptop allowed an attacker to access an internal software environment and submit unauthorized withdrawal transactions. The exchange found no evidence of a wallet private-key leak.
Binance revoked the affected address authorization and engaged law enforcement and blockchain-intelligence partners. A detailed technical report would follow its investigation.
Bitquery traced approximately $6.3 billion leaving 17 Binance hot wallets across nine networks between 1:34 a.m. and 5:26 a.m. IST on Oct. 30. Its estimate puts the incident at more than four times the approximately $1.5 billion Bybit theft reported in February 2025.
Binance Pledges to Replace Lost Funds
Completed blockchain transfers cannot simply be cancelled by Binance. The exchange stated that the partners had frozen approximately $3 billion and were pursuing recovery.
Frozen assets remain separate from returned funds. Binance’s pledge is to replace all losses using its Secure Asset Fund for Users, known as SAFU, and company funds, rather than relying solely on recovering the stolen assets.
For Binance, the financial burden depends on how much is ultimately recovered. Replacing unrecovered assets would consume company resources, while security repairs and investigations create additional costs. The incident also puts pressure on Binance to demonstrate that customer balances remain fully backed.
Withdrawal Reopening Becomes a Test of Confidence
A prolonged withdrawal suspension could weaken customer confidence and lead some users to move assets elsewhere once transfers resume. That would increase demands on readily available funds, although the incident disclosures do not establish that Binance faces a liquidity shortfall.
In its Oct. 30 service update, Binance expected withdrawals to resume within the following 48 hours. It gave no fixed reopening time and cleared that the further details would come through official channels. The exchange also promised updated proof-of-reserves information after remediation, providing customers with another measure of its asset backing.
