Binance’s $6.3bn hack puts withdrawal controls under scrutiny

Binance said hackers stole about $6.3 billion from its wallets on Oct. 29, prompting the exchange to pause withdrawals while it checked security and worked to trace funds. The scale makes the breach the largest crypto theft reported to date by dollar value: The Associated Press’s account of the incident compares it with the roughly $1.5 billion stolen from Bybit in February 2025. Binance’s announcement said deposits remained open; it did not say trading had stopped.

How did the attackers reach Binance’s wallets?

Binance’s initial findings point to unauthorized access to an internal wallet-signing service, which allowed transactions to be initiated outside the normal withdrawal process. In its Nov. 3 incident update, the exchange described an attacker gaining access through compromised employee devices and credentials before deploying a container and malicious script. The company said five hot wallets sent 233.46 million XRP to an attacker-controlled address in four minutes; its report also describes transfers from wallets on Solana and Optimism.

That distinction matters. The reported route was through software and access used to authorize transactions, rather than a disclosed theft of wallet private keys. Binance said it had found no evidence of a private-key leak in its earlier updates, while its later account described the signing service as the point the attacker reached. Hot wallets are kept online to process withdrawals quickly; that speed also means a compromised signing path can expose assets before a manual response catches up.

How large is the loss beside the previous record?

At about $6.3 billion, the estimated value is more than four times Bybit’s $1.5 billion loss. The comparison is in dollars at the time of each theft, and does not measure every possible impact: Binance founder Changpeng Zhao noted that the amount of bitcoin affected in other incidents, including Mt. Gox, could be larger even if their dollar value at the time was lower, according to AP.

Binance said it would cover customer losses and had set aside company funds for that purpose. It also reported working with blockchain partners to freeze roughly $3 billion in affected assets. Freezing tokens can limit how much of a theft can be spent, but it depends on whether issuers or network operators can intervene and whether funds have already moved into assets or services beyond their control. The remaining amount is not necessarily recovered just because customers are promised reimbursement: the company must bear the loss if tracing and freezes do not return the assets.

What should users and the market watch next?

The immediate signals are whether Binance publishes the updated proof of reserves it promised after remediation, how much of the stolen crypto is ultimately recovered, and what an independent cybersecurity review finds. Binance said it had rebuilt the affected wallet system and would commission an outside review; its public findings may clarify how long compromised access persisted and which controls failed to stop unauthorized signing.

For users, the incident also shows the difference between keeping an exchange open for deposits or trading and letting customers withdraw assets. Pausing withdrawals can contain further losses while checks run, but it leaves customers unable to move funds during the investigation. Binance’s next updates will need to show whether its rebuilt controls can restore withdrawals without reintroducing the same signing risk, and whether the promised compensation and proof of reserves match the scale of the breach.

Source material

• Associated Press’s account of the incident — apnews.com
• Nov. 3 incident update — binance.bh