Binance Faces Historic $6.3 Billion Breach: CEO Reveals Withdrawal Plans!

Binance has vowed to cover an estimated $6.3 billion loss due to a recent breach, yet users continue to await the reactivation of withdrawal features.

The cyber attack occurred on October 29, prompting Binance to expand its investigation on October 30. Initially focused on a compromised laptop, the inquiry has since broadened. The exchange claims it has allocated over $6.34 billion from its own resources to compensate for the stolen assets, with around $5 billion already held in the impacted cryptocurrencies and plans to acquire the rest underway. Co-CEO Richard Teng mentioned in a recent transcript that the revamped withdrawal system would be reinstated only after thorough testing. He noted that the deadline set for Sunday is still in progress, expressing optimism that users might regain access to withdrawals sooner.

This serves as a goal rather than a firm reopening declaration. According to Binance’s latest service updates, deposits are functioning normally while withdrawals are still suspended. Teng also promised a comprehensive Proof of Reserves report by Monday, November 2, with hopes of providing an initial overview even earlier. The ‘Sunday’ he references is November 1, offering customers tangible deadlines to evaluate the exchange’s claims rather than ambiguous assurances regarding service functionality. It’s crucial to note that a visible account balance does not equate to a fully operational withdrawal feature.

Funds reserved, but withdrawals still halted

The reserves claimed by Binance are distinct from approximately $3 billion in assets reported to be frozen by partners. Their funding update explicitly stated that frozen or secured assets were not included in the $6.34 billion commitment. Recovery and verification of these assets are still pending. Binance asserts it is procuring the missing token amounts through market transactions and over-the-counter trades, but notes that limited liquidity and settlement delays may slow this process. Thus, indicating a set dollar amount does not imply that every replacement token is immediately available. Although the company has committed to making the losses right, its promised reserve disclosures are yet to come.

According to an independent analysis by Elliptic, updated at 13:10 UTC on October 30, the theft is estimated at $6.43 billion, with $2.84 billion frozen on-chain. This figure is separate from Binance’s final assessment. Elliptic labels this incident as the largest cryptocurrency theft ever recorded, greatly surpassing the $1.46 billion stolen from Bybit last year. Much of the frozen assets are in stablecoins, which issuers can restrict. Unlike stablecoins, Bitcoin and native ether are not subject to the same limitations, requiring investigators to trace transactions and act upon funds once they reach exchanges. Merely freezing a token does not automatically return it to Binance’s control.

Beyond the compromised laptop: attribution still unclear

The technical details surrounding the breach continue to evolve. Binance initially indicated that a DevOps engineer’s potentially compromised laptop was involved, noting no evidence of wallet private key leaks. They have since revealed additional points of breach but have not disclosed the complete series of events leading to the attack. An investigation by TRM Labs suggests the Ethereum aspect utilized EIP-7702, a feature allowing wallet execution to be delegated through smart contracts. The attacker leveraged signed certifications to introduce harmful actions into a hot wallet, while wallets on other blockchains conducted standard signed transfers. TRM interprets this broader activity pattern as indicative of weakened signing infrastructure. Teng’s latest description indicates that this delegation circumvented regular approval checks, and that the attackers eliminated tools and traces; these findings are pending the release of a complete technical report.

TRM confidently attributes the attack to North Korea’s TraderTraitor group, while Elliptic finds North Korean participation plausible. However, Elliptic warns that shared laundering addresses do not definitively link separate thefts to the same hackers. Their report notes that no government or law enforcement organization has confirmed the attribution. For customers, the pressing inquiries are whether withdrawals will resume, if the declared reserves will align with impacted assets, and what the final findings will reveal about the lapses in controls. Teng mentioned that the review now encompasses devices, cloud infrastructure, key management, and signing systems throughout the organization. The next significant update should provide evidence of the completion of repairs and asset purchases, rather than simply reiterating the compensation promise.