How attackers drained $6.3 billion from Binance wallets

Attackers drained about $6.3 billion from Binance hot wallets on Oct. 29, the exchange said, in what blockchain analysts describe as the largest crypto theft on record. Hot wallets hold assets online so an exchange can process transactions; cold wallets keep most assets offline. Binance says its hot wallets were compromised, and it will cover the losses for users.

The transaction path matters because moving funds out of a wallet requires authorization. In its Oct. 30 report, Reuters cited TRM Labs’ analysis that attackers compromised Binance’s signing infrastructure, which authorizes transactions, and used it to issue instructions that emptied affected wallets. Reuters reported that the bulk of the theft took about 20 minutes. Binance says its investigation found additional points of breach but has not yet published a full technical account.

How did the attackers get transactions approved?

TRM’s account, as reported by Reuters, describes a failure in the system that approves transactions. That is different from evidence that the attackers simply stole wallet private keys: Binance said it had found no evidence of a private-key leak in its Oct. 30 update. In everyday terms, the signing system is like a cashier authorized to open a safe; an attacker who can control the cashier’s instructions may move funds without taking the safe’s key.

The exchange has not confirmed the full sequence. Binance initially said a compromised laptop may have been involved, then said investigators found other breach points. It has described the attack as complex and says its review is ongoing, so the precise route from the breach to each unauthorized withdrawal remains unconfirmed.

What happened to the stolen assets?

Some were frozen after the transfers. Binance said in its official incident update on Oct. 30 that about $3 billion had been frozen on-chain through work with law enforcement, blockchain firms, asset issuers and industry partners. This matters because some token issuers can freeze their tokens at an address. Bitcoin and ether do not have a central issuer with that same control, so tracing or freezing them can depend on other services or law enforcement.

Freezing assets does not by itself return them to Binance. The exchange said it had set aside more than $6.34 billion in company funds, with $5 billion held in the same token assets that were stolen, and was buying the remainder. It also temporarily suspended withdrawals while reviewing and securing affected systems; deposits and other unaffected services remained operational, according to the update.

What changes for Binance users now?

Binance says it will absorb the financial loss and is working to restore withdrawals safely. The exchange’s Oct. 30 update set out plans for a phased reopening and a technical postmortem after its security review. The change so far is that Binance has confirmed the scale of the loss, committed company funds to cover it and begun recovery work. The next points to watch are the withdrawal status, the amount of assets recovered, and the technical findings Binance publishes.

References

• Oct. 30 report, Reuters cited TRM Labs’ analysis — investing.com
• official incident update on Oct. 30 — binance.com