Binance Confirms $6.3B Security Breach, Freezes $3B in Assets and Pledges Full Compensation

The exchange says blockchain partners have frozen approximately $3 billion in affected assets. Binance has also pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and company resources. However, the incident raises serious questions about its internal security controls and the safeguards protecting customer assets.

Binance Traces $6.3B Security Breach to Compromised DevOps Laptop

In an official security update published on October 30, Binance said its preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer. The attacker allegedly used the device to access a service container and submit unauthorized withdrawal transactions.

Binance reports a $6.3 billion security breach involving a compromised DevOps engineer’s laptop while confirming that no wallet private keys were exposed. Source: Binance/X

Binance stated that it had found no evidence of wallet private key exposure. However, that does not make the incident any less serious. The apparent ability to exploit an internal service and trigger legitimate withdrawal processes exposes a critical weakness in the exchange’s operational security. Private keys may have remained protected, but the systems authorized to move funds were apparently not sufficiently insulated from compromised internal access.

CZ assures users that funds remain SAFU and will be fully covered by the SAFU fund and company resources, while praising hundreds of employees for their overnight response efforts. Source: CZ/X

Independent blockchain analysis firm TRM Labs traced approximately $6.36 billion in transfers from Binance wallets across 10 blockchains on October 29. The transfers reportedly occurred within a relatively short period, with most of the movement taking place in approximately 20 minutes. The affected networks included Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon.

TRM Labs also attributed the attack to TraderTraitor, a North Korean-linked hacking group, based on its on-chain and off-chain intelligence. The firm expressed high confidence in its assessment, although Binance has not publicly confirmed the attribution. TRM described the incident as the largest cryptocurrency theft on record, placing its estimated scale at more than four times the $1.5 billion Bybit hack in February 2025.

Nearly $3B Frozen as Tether and Circle Join Recovery Effort

Binance says approximately $3 billion in affected cryptocurrency has been frozen through cooperation with blockchain partners. The recovery effort involves law enforcement agencies, blockchain intelligence firms, and stablecoin issuers, including Tether and Circle.

Binance confirms it has frozen approximately $3 billion in assets linked to a major security breach affecting hot wallets across multiple blockchains. Source: Binance/X

The involvement of external companies has been particularly important because centralized stablecoin issuers can restrict transfers from identified addresses. Tether reportedly froze nearly $1.57 billion in assets connected to the incident, while Circle froze more than $800 million. Binance co-CEO Yi He also said Ripple had frozen approximately $200 million associated with the attack.

TRM Labs’ on-chain assessment put the total amount frozen at approximately $2.7 billion, including assets restricted by stablecoin issuers and emergency action taken by the Arbitrum Security Council. The difference from Binance’s rounded $3 billion figure reflects the different reporting snapshots and tracking scope.

Despite these interventions, freezing assets does not automatically mean the funds have been returned to Binance or their rightful owners. TRM estimated that attackers still controlled approximately $2.4 billion in cryptocurrency at the time of its assessment, including substantial amounts of Bitcoin and Ether. The remaining funds could prove considerably harder to recover if they move through decentralized exchanges, lending protocols, bridges, or other services.

The incident also highlights an uncomfortable reality for Binance. A substantial part of the recovery effort has depended on other companies identifying suspicious wallets and restricting the movement of assets after the withdrawals occurred. For an exchange handling billions of dollars in customer transactions, the effectiveness of preventive security controls deserves at least as much scrutiny as the industry’s response after the breach.

Binance Withdrawals Remain Suspended as Users Face Trading Disruptions

Binance initially suspended both deposits and withdrawals while its security team investigated the incident, revoked authorization for the affected address, and reviewed its withdrawal infrastructure.

Binance confirms deposits remain operational, while withdrawals are suspended for up to 48 hours to complete security upgrades. Source: Binance/X

The exchange later clarified that deposits were operating normally, while withdrawals remained paused during a security overhaul. Binance said it expected to begin restoring withdrawal services within 48 hours. However, that timeline represents an expected resumption rather than confirmation that all withdrawal functions have returned to normal.

The suspension also created practical problems for customers who needed access to their assets during volatile market conditions. One user posting as OkanErtem07 reported that a ZRO withdrawal had remained in “Processing” for hours, leaving the user unable to cancel the request or trade the tokens. The user claimed that the delay prevented a planned sale near $1.60 before the token price declined.

Okan Ertem reports that Binance’s security freeze left his ZRO withdrawal stuck in processing, preventing cancellation or trading and causing him to miss a $1.60 sale before prices declined. Source: @OkanErtem07/X

Although this individual account has not been independently verified, it illustrates an important consequence of exchange-wide security suspensions. Customers can face losses or missed trading opportunities even when their account balances remain intact. A withdrawal restriction can effectively prevent users from responding to market movements, managing positions, or moving assets to alternative platforms.

Binance’s assurance that customer funds are safe therefore does not address every concern created by the incident. Customers also need reliable access to their holdings and clear information about pending transactions, withdrawal backlogs, and service restoration.

Binance Pledges Full Compensation and Updated Proof of Reserves

Binance has committed to covering all losses associated with the security incident using its SAFU fund and company resources. The pledge is intended to reassure customers that the estimated $6.3 billion impact will not translate into losses for their account balances.

Binance pledges to fully cover all losses resulting from the major security incident. Source: Binance/X

However, the exchange has yet to publish a complete technical explanation of the breach or provide a detailed breakdown of how its compensation process will operate. Its announcement does not explain how the final losses will be calculated, how recovery efforts will affect the amount ultimately covered, or whether any additional customer claims will require separate procedures.

The SAFU fund, established to provide an emergency financial buffer for users, is central to Binance’s commitment. Nevertheless, customers should not have to rely solely on public assurances when an incident of this scale exposes weaknesses in the systems responsible for protecting their assets.

Binance has also promised to publish an updated Proof of Reserves after completing the security remediation. The update could help provide a clearer view of the exchange’s asset backing following the incident. However, reserve disclosures alone cannot establish whether internal access controls, transaction authorization processes, and withdrawal monitoring systems are secure.

The company has promised a detailed technical post-mortem once investigators verify the facts. That report will be particularly important in determining how a compromised employee device gained access to withdrawal infrastructure, why existing safeguards failed to prevent unauthorized transactions, and what changes will stop similar attacks.

For now, Binance faces two separate challenges: recovering the remaining cryptocurrency and restoring confidence in the security of its platform. Its compensation pledge addresses the immediate financial concern, but it does not erase the operational failure behind the breach. The real test will be whether Binance can provide verifiable answers, restore normal withdrawal services, and demonstrate that its security infrastructure has been fundamentally strengthened.