Binance Confirms Record $6.3bn Hack, Reopens Withdrawals

Binance suffered a security breach in which approximately $6.3 billion was stolen from the exchange's hot wallets, the company confirmed in a series of updates published across the weekend, in an incident it described as the largest theft from a cryptocurrency platform on record.

The breach occurred on the evening of 29 October, at approximately 20:05 UTC, through a compromised DevOps machine belonging to the exchange's engineering staff, and Binance suspended withdrawals across the platform as the scale of the theft became apparent. The compromise was quickly attributed to the TraderTraitor operation associated with North Korea's intelligence apparatus, consistent with patterns attributed to the country's cyber programme in prior attacks on cryptocurrency firms.

The scale of the theft and what has been recovered

The $6.3 billion figure, imposed by the market's structure, exceeded the previous largest crypto theft by a wide margin, which was the $1.5 billion by the Bybit hack in 2025, and the immediate actions taken by the exchange and its partners in the industry succeeded in freezing approximately half of the stolen assets, around $2.54 billion, through coordination with other exchanges and service providers.

Binance reported on 31 October that about 80% of the stolen funds had been covered, through its Secure Asset Fund for Users and, in part, through the treasury set aside for the purpose, which includes repurchasing the impacted tokens, and the company committed itself to replenishing the remaining balance through the following measures originally intended to protect against platform-wide theft.

Operational questions the hack will test

The exchange's recovery depends on the reliability of two systems it had previously tested only in theory. The Secure Asset Fund for Users, known as SAFU, was designed as an emergency fund to protect users in extreme cases, and this is the first time the mechanism has been applied at scale for a breach of this size, making the replenishment programme a live test of the industry's insurance architecture.

Co-CEOs Yi He and Richard Teng have presented a consistent message across the public updates, which began on the day of the breach and continued through the weekend, and the exchange's latest update on 1 November confirmed that withdrawals would be resumed in phases, with the company targeting a return to normal service within approximately 34 hours. The credibility of that timeline is now what the exchange's customers and counterparties will observe, because resumed withdrawals are the mechanism by which the market's confidence in the platform is measured.

What the attack says about security in crypto

The mechanics of the breach, a compromise of a single engineer's device leading to an attack on the hot wallets, recalls the identical pattern of the 2025 Bybit intrusion, in which the attackers' route to the funds came through infrastructure rather than through cryptographic weaknesses.

The repetition of the pattern tells us what the industry's real vulnerabilities are: the operational security of the people and machines that control the wallets, rather than the cryptographic technology itself, and the counter-measures that have been developed in response, including multi-signature controls, withdrawal limits and frameworks for cross-industry fund tracking, are the elements on which the next attack's outcome will turn. For the industry as a whole, the freezing of $2.54 billion within hours of the theft through industry coordination is the functional new element, which is the part that mitigates the damage on a scale that would not have been possible a few years ago.

Context for Nigerian and African traders

Nigeria and Kenya are among the continent's largest cryptocurrency markets, and Binance is the dominant exchange in the region's peer-to-peer trading, so the breach and the exchange's response have direct consequences for African users whose funds sit on the platform.

The exchange's commitment to covering the losses from its own funds means users' balances are protected by the platform's balance-sheet strength rather than by the security of the wallet technology, and the lesson for African users and regulators is a familiar one: the concentration of trading volume on a single platform is the concentration of operational risk, which makes diversification of holdings across platforms and self-custodied wallets a practical risk-management response even in the presence of the insurance arrangements that protected users in this case.