Skip to main content
Merkle Street

Protocols, markets, policy, people

Binance says $6.3bn hack drained hot wallets in 20 minutes

Binance says attackers drained about $6.3 billion from hot wallets, while the exchange says it will cover losses and partners have frozen roughly $3 billion.

Merkle Street Newsroom#340c193 min read

Binance says $6.3bn hack drained hot wallets in 20 minutes

Hackers stole about $6.3 billion from Binance hot wallets on Oct. 29 in what the exchange says is a major security incident and blockchain firms describe as the largest crypto theft on record. Hot wallets hold crypto used to process transactions. Binance’s incident update says attackers made unauthorized withdrawals; the exchange has temporarily suspended withdrawals while it checks and secures affected systems. Deposits and other unaffected services remain operational, according to Binance’s Oct. 30 update.

To send funds from a wallet, a transaction needs authorization through signing infrastructure. TRM Labs told Reuters that attackers compromised this infrastructure, which authorizes transactions, and used it to issue instructions that emptied affected wallets. That is like breaking into the system that approves payments, rather than taking a physical key. Binance says it has found no evidence that wallet private keys were leaked, and says its investigation uncovered additional breach points beyond an initially suspected compromised laptop.

How did the attackers move the funds?

The bulk of the outflows happened in about 20 minutes, according to blockchain records cited by Reuters’ account of the attack. The stolen tokens moved from Binance wallets across multiple blockchains. Some assets, including USDT and USDC stablecoins, can be frozen by their issuers. Bitcoin and ether do not have a central issuer that can freeze them, Reuters reported, so stopping those funds may depend on exchanges or law enforcement.

Binance says it has worked with blockchain partners, law enforcement and token issuers to freeze about $3 billion on-chain so far. A freeze can limit an attacker’s ability to move or convert tokens, but it does not by itself return them to Binance.

Who is suspected, and who covers the loss?

TRM Labs attributed the attack to TraderTraitor, a North Korean hacking unit, with “high confidence,” according to the Associated Press. Binance says it is still working with law enforcement to identify those responsible, so the attribution remains an outside firm’s assessment, not a confirmed finding by the exchange.

Binance says it will cover the stolen funds through its Secure Asset Fund for Users and corporate treasury. It says it has set aside more than $6.34 billion, including $5 billion in the affected tokens, and is buying the remaining assets. The exchange also says roughly $3 billion has been frozen. Withdrawals remain suspended as Binance completes security checks; its update targets a phased restart within about 34 hours, subject to those checks.

Source material