The Binance hack affected about US$6.3 billion in cryptocurrency assets after unauthorized withdrawals were made from several exchange-controlled wallets on Thursday, October 29.
Binance said on Friday, October 30, that it had temporarily suspended deposits and withdrawals while security checks continued, but that customer funds remained safe and the company would cover losses through its Secure Asset Fund for Users and corporate funds.
Table of Contents
What happened in the Binance hack
Binance’s preliminary investigation points to a compromised laptop used by a DevOps engineer as a possible entry point for the attacker.
The attacker allegedly used access to a service container to submit unauthorized withdrawal transactions, according to the exchange.
Binance said it had found no evidence that wallet private keys were leaked, although it has not yet published a full technical post-mortem.
Blockchain analysis indicates that assets were moved across multiple networks, including Bitcoin, Ethereum, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
TRM Labs said the first major transfers began on October 29, including the movement of approximately 18,270 Bitcoin, more than 200,000 Ether and large quantities of stablecoins and other tokens.
About US$3 billion in assets frozen
Binance estimated the total impact at approximately US$6.3 billion and said about US$3 billion had been frozen on-chain with help from blockchain partners.
Asset freezes can prevent some stolen tokens from being moved or converted, but they do not automatically guarantee that all funds will be recovered.
Binance said its teams had revoked the affected address authorization and were working with law-enforcement agencies and blockchain intelligence firms to trace the remaining assets.
The exchange also said it would publish an updated proof-of-reserves report after remediation work is completed.
Withdrawals remain suspended
The suspension affects deposits and withdrawals while Binance reviews its systems and the addresses connected to the incident.
The exchange has said other platform services continue to operate, while a separate Binance statement indicated that withdrawal operations would resume after the verification process is complete.
Binance users should rely on notices inside the official platform and verified Binance communication channels rather than links or messages claiming to offer emergency withdrawals.
Customers should also avoid sharing passwords, authentication codes, recovery phrases or private keys with anyone claiming to represent the exchange.
Researchers point to North Korean hackers
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korea-linked hacking operation that has been associated with previous large cryptocurrency thefts.
The firm said the attackers appeared to prepare the operation for at least 36 hours, testing code and staging wallets before executing a burst of transactions.
That attribution remains separate from Binance’s own preliminary technical explanation, which focuses on the suspected compromise of an employee laptop and unauthorized access to a service container.
Authorities and investigators may revise the attribution as more wallet movements, infrastructure records and exchange logs become available.
Why the incident matters
The scale of the Binance hack makes it a major test of whether centralized crypto exchanges can isolate hot-wallet systems from internal development and operations environments.
It also highlights the difficulty of protecting assets that must remain available for customer trading and withdrawals.
Hot wallets are connected to online systems and are generally more exposed to operational and cybersecurity risks than offline cold-storage wallets.
Binance said there was no evidence that customer funds had been compromised and promised to absorb the losses rather than pass them directly to users.
That assurance will likely be tested by the company’s forthcoming proof-of-reserves update, technical post-mortem and any regulatory or law-enforcement findings.
What happens next
Binance’s immediate priorities are expected to include completing security checks, restoring withdrawal services safely, tracking the attacker’s wallets and determining how much of the stolen cryptocurrency can be recovered.
The exchange is also expected to provide more detail about the compromised device, the service-container access and the controls that allowed unauthorized transactions to be submitted.
Until withdrawals resume, users should check their account status directly through Binance’s official website or application and should not attempt to use unofficial recovery services.
Frequently Asked Questions
How much cryptocurrency was affected by the Binance hack?
Binance estimates that about US$6.3 billion in cryptocurrency assets were affected by the incident.
Are Binance customer funds safe?
Binance says customer funds are safe and that it will cover losses through its SAFU fund and corporate funds, although the investigation remains ongoing.
Why are Binance withdrawals suspended?
Deposits and withdrawals were temporarily suspended while Binance completes security checks and reviews the affected withdrawal systems and addresses.
Who is believed to be behind the Binance hack?
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korea-linked hacking operation, but the attribution could change as the investigation develops.
How much stolen cryptocurrency has been frozen?
Binance says approximately US$3 billion in affected assets has been frozen on-chain with assistance from blockchain partners.
Fact-Checked: Key figures, the withdrawal suspension, Binance’s preliminary findings and the asset-freeze estimate were checked against Binance’s official incident update and TRM Labs’ analysis. ([binance.com](https://www.binance.com/en-TR/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7?utm_source=openai))
Disclaimer: The investigation is ongoing, and Binance’s estimated loss, recovery total and attribution may change as additional technical and law-enforcement findings are released.