Skip to main content
Aeterna Sol

Crypto markets, protocols and policy

Binance says 95% of $6.3B security impact is covered

Binance says it has covered about 95% of assets affected by a $6.3 billion breach, resumed withdrawals in phases and made reserve backing verifiable to users.

The Aeterna Sol Editors

Binance says 95% of $6.3B security impact is covered

$6.3 billion is Binance’s estimate of the impact from a security incident that led to unauthorized withdrawals. The exchange says it has covered about 95% of that amount and is restoring withdrawals in stages.

Binance’s latest recovery update, published Monday, says users can now verify that balances in ten listed tokens are backed at least one-to-one. The company says it will absorb the financial impact rather than pass losses to users.

How did the attacker get access?

Binance’s initial investigation points to a compromised laptop belonging to a DevOps engineer, a technical employee who works on the systems that build and operate software. The attacker may have used access from that laptop to enter a service container and submit unauthorized withdrawal transactions, Binance said.

The exchange said it found no evidence that wallet private keys had leaked. It has not published a complete technical account of the incident. The Associated Press report described Binance’s initial response: the exchange said it was investigating and had worked with blockchain partners to freeze about $3 billion in affected assets.

The estimated $6.3 billion impact and the approximately $3 billion frozen on-chain are separate figures. Binance’s updates do not say that all of the remaining amount has been recovered from the attacker.

What has Binance done to restore access?

Binance began reopening withdrawals in phases on Nov. 1, after temporarily suspending them while it checked affected services. Deposits remained open, according to the exchange. The first withdrawal phase covered selected assets across networks including Bitcoin, Ethereum, BNB Chain, Tron and Solana.

The staged return means access depends on the asset and network you choose. Binance said it would add more networks and assets after completing readiness and security checks, and warned users that traffic could cause delays during the initial rollout.

The company also said it had replenished about 95% of the impacted amount with its own resources. That leaves roughly 5% outstanding, made up of tokens outside its top ten listed assets that Binance described as less liquid and slower to source at scale.

How can users check the reserve update?

Binance says its latest reserve snapshot covers BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. For those ten tokens, the company says balances are fully backed at 100% and users can verify their own balances against the snapshot using its proof-of-reserves tool.

The update uses a zero-knowledge proof, a cryptographic method Binance says lets users check reserve backing without exposing individual balances. The snapshot records assets at 00:00 UTC on Oct. 31; it is not a live view of reserves.

Binance plans another snapshot on Nov. 4 to include more tokens, followed by another proof that the company estimates will take 40 to 50 hours to generate. It has also said it will publish a technical post-incident report after its investigation is complete. Until then, the cause and full mechanics of the breach remain subject to that investigation.

Sources