Key Takeaways
- Binance targeted a phased withdrawal restart, subject to completed security checks.
- Matching tokens worth $5 billion cover approximately 80% of losses.
- Binance said partners froze about $3 billion in stolen assets.
Withdrawals Face Security Checks Before Phased Restart
Binance outlined a four-part hack recovery plan on Oct. 30 in its second Security Incident Update, targeting the start of withdrawal restoration within approximately 34 hours of the update. Its phased withdrawal restart remained subject to completed security checks, remediation, and validation of affected systems. Deposits and other unaffected services remained operational, according to the announcement.
Co-CEOs Yi He and Richard Teng signed the update, which placed the hot-wallet compromise at approximately 8:05 p.m. UTC on Oct. 29. Addressing the estimated $6.3 billion loss, the statement emphasized:
“Binance will absorb the financial impact of these stolen funds, not our users.”
The exchange pledged coverage through its Secure Asset Fund for Users (SAFU) and corporate treasury, or company financial reserves.
Token Purchases and Asset Freezes Anchor Recovery
More than $6.34 billion in company funds reserved for losses included $5 billion already held in the affected token assets, Binance said. Those holdings matched approximately 80% of losses involving assets such as USDC, USDT, BTC, ETH, and BNB. Purchases through market and over-the-counter channels were underway to obtain the remaining matching tokens.
Approximately $3 billion had been frozen onchain, Binance reported, while recovery efforts continued with law enforcement, token issuers, intelligence firms, and other exchanges. Blockchain analytics firm Elliptic’s independent analysis of tracing and freezing stolen assets put verified freezes at $2.84 billion as of its 8 a.m. UTC update on Oct. 30, predominantly involving USDT and USDC. Frozen funds remained subject to recovery efforts.
Investigators tracing stolen assets can examine wallet balances and transfers through public blockchain transaction records. Separately, Binance planned an initial proof-of-reserves snapshot within 12 hours of its announcement. Results were expected by Monday, Nov. 2, showing platform holdings against customer balances.
Expanded Investigation Examines Signing Access
The initial laptop-compromise findings suggested a compromised DevOps engineer’s computer enabled unauthorized withdrawal submissions. DevOps engineers maintain software deployment and the infrastructure supporting it. Binance maintained that it had found no evidence of leaked wallet private keys.
Teng’s separate Oct. 30 video described additional breach points, bypassed approval controls, and a self-destruct mechanism that destroyed tools and traces. Binance said it had contained compromised infrastructure, revoked affected authorizations, and introduced further controls against unauthorized activity. Internal and external specialists were working to reconstruct the full attack sequence.
Blockchain security firm Hypernative’s analysis identified compromised signing access and valid signatures from Binance-controlled keys. It described the use of EIP-7702, an Ethereum feature that lets a regular wallet execute smart-contract code, to run attacker-controlled code through a Binance wallet. Binance expected further verified technical findings within about 48 hours of its announcement, subject to investigative considerations, followed by a detailed post-mortem covering the attack and safeguards.
