Binance says $6.3bn security incident has left withdrawals paused as $3bn of assets are frozen

Binance says a 30 October security incident has an estimated impact of about $6.3 billion, with approximately $3 billion in affected crypto assets frozen on-chain through coordination with ecosystem partners. Withdrawals remain paused in the company's cited service update. Its formal announcement, updated at 11:36 on 30 October as displayed on the page, clarifies that deposits remain unaffected and continue to operate normally. The clarification should not be described as a confirmed reopening of a deposit service that had stopped.[1][2]

The exchange initially said its investigation pointed to a compromised laptop used by a DevOps engineer, potentially allowing an attacker to access service infrastructure and submit unauthorised withdrawal transactions. Binance subsequently said the attack involved multiple factors and that it was still tracing the complete path. It states it has found no evidence that wallet private keys were leaked. None of that establishes a final technical root cause or an identified attacker, and the promised post-mortem had not yet been published in the disclosures reviewed.[1][2]

What the freeze numbers actually mean

Dividing the approximately $3 billion Binance reports as frozen by the estimated $6.3 billion impact gives approximately 47.6%. This is a derived ratio between two figures of different status, not proof that the other 52.4% has been irretrievably lost. A freeze prevents movement of particular assets at a point in time; recovery, legal title, chain-specific restrictions and the availability of funds to settle customer obligations remain separate processes. Binance acknowledges that competing figures for frozen assets circulated and identifies $3 billion as its current verified total.[1][2]

Binance says it will cover losses using its Secure Asset Fund for Users and corporate resources, and plans to issue an updated proof of reserves after remediation. That commitment is relevant to customer protection but is not equivalent to completed reimbursement, evidence of the fund's immediately accessible liquidity or a completed independent audit. The operational test is whether withdrawal functionality, reconciliation and customer balances can be restored under reliable controls.[1][2]

For brokerage operators, the case highlights the distinction between maintaining account balances on a ledger, controlling privileged infrastructure that can authorise transfers, and managing asset recovery after unauthorised transactions. An exchange can assert that customer funds remain safe while separately suspending transfers to prevent additional movement. Neither an assurance nor a withdrawal suspension proves that every customer account has been individually reconciled.[1][2]

What remains unknown

Binance says it expects withdrawal service to resume within 48 hours, but gives that as a forecast while remediation continues. It has also promised a technical post-mortem and updated proof of reserves. The final attack path, recoverable amount and completed customer reimbursements remain unresolved in the cited updates. The frozen-asset total is Binance's reported figure; it has not been independently audited for this article.[1][2]

Report an error or submit an update