Binance freezes withdrawals after $6.3bn crypto theft

Binance suspended withdrawals on Friday, Oct. 30, after reporting a security breach with an estimated $6.3 billion impact, in what the Associated Press called the largest cryptocurrency heist on record. The exchange said it would cover users’ losses and that deposits were unaffected, according to its security incident update.

What did the attackers take, and how?

Binance’s initial investigation suggested an attacker may have used a compromised engineer’s laptop to gain access to a service container and submit unauthorized withdrawals. The exchange said it found no evidence that wallet private keys had leaked, and that it would publish a technical report after the investigation is complete.

Blockchain firm TRM Labs told the AP that about $6.36 billion was moved from Binance wallets across 10 blockchains, mostly within about 20 minutes. TRM attributed the attack to North Korea-linked group TraderTraitor with high confidence; Binance said it was still working with law enforcement to identify those responsible.

How much could Binance recover?

Binance said about $3 billion in affected assets had been frozen on-chain. The exchange also said it would cover losses through its Secure Asset Fund for Users and company funds; AP reported that Binance had reserved more than $6.34 billion to do so.

The breach affected Binance’s own hot wallet, according to co-CEO Richard Teng, who said most user assets are held in offline cold wallets. Binance said it was working with blockchain partners to trace and recover funds.

When will withdrawals resume?

Binance said it had temporarily suspended withdrawals while it completed a security review; it did not announce a confirmed restart time in the update. AP reported that withdrawals were expected to resume in the next day or two, while the exchange’s investigation into the breach and the identities of the attackers remained ongoing.

Source material

• security incident update — binance.com