‘Binance will absorb impact, not users’: Crypto giant sets aside $6.34 bn to cover losses

Binance reported that its hot wallets were compromised at about 20:05 UTC on October 29. This led to unauthorised withdrawals worth approximately $6.3 billion in digital assets. The incident matters because hot wallets hold cryptocurrency in an arrangement connected to active exchange operations, making them important targets during a breach.

Once attackers reached the affected wallets, they could initiate withdrawals without users’ permission. The stolen assets included cryptocurrencies such as USDC, USDT, Bitcoin, Ether and BNB. Binance later said it found no evidence that wallet private keys had been leaked, while its investigation identified additional points of intrusion beyond a possibly compromised laptop.

Binance is absorbing the financial impact rather than passing it to users. It has already bought back about $5 billion in stolen assets and frozen roughly $3 billion across blockchain networks. Withdrawals were being restored in phases after security checks, while a technical report and further findings were planned.

A hot wallet is a cryptocurrency wallet kept connected to online systems so digital assets can be received, traded or withdrawn quickly. Exchanges commonly use such wallets for active operations. Their main benefit is speed, but that same connection creates an attack surface that an offline wallet does not normally have.

For example, Binance said its hot wallets were compromised, leading to unauthorised withdrawals of approximately $6.3 billion. An attacker who reaches the systems controlling an online wallet may be able to request transactions or exploit related security weaknesses. The article says Binance initially considered a compromised laptop, then found additional points of breach. It found no evidence that private keys had leaked.

Keeping a wallet offline reduces its exposure to internet-based attacks because it is not continuously connected to exchange systems. It does not remove every possible risk, such as human error or physical compromise. Binance’s response shows why exchanges must combine wallet controls, monitoring and security checks before restoring withdrawals.

Binance reported that it had already bought back approximately $5 billion worth of the stolen cryptocurrencies. That equals about 80 per cent of the approximately $6.3 billion stolen in the breach. It was using its own resources to restore the assets connected to affected users rather than leaving them to absorb the loss.

The recovered or replaced assets included USDC, USDT, Bitcoin, Ether and BNB. Binance said it was purchasing remaining relevant tokens through market and over-the-counter channels. Separately, it said approximately $3 billion of stolen funds had been frozen across blockchain networks. The figures describe different actions, so they should not automatically be added together as unique recovered assets.

The remaining tokens were still being pursued when Binance issued its update. The exchange was also coordinating with law enforcement, blockchain intelligence firms, asset issuers and industry partners. Its ability to replace most of the reported loss supports its promise that users would not bear the financial impact, though the investigation and recovery work continued.

Binance said compensation would come from its Secure Asset Fund for Users, known as SAFU, and its corporate treasury. It set aside more than $6.34 billion to make up for stolen assets. This matters because the exchange is taking responsibility for the financial impact instead of charging affected users directly or reducing their account balances.

The mechanism is straightforward: Binance uses reserves already held for user protection and company funds to buy replacement cryptocurrency. It had already bought back about $5 billion, including USDC, USDT, Bitcoin, Ether and BNB. It was seeking the remaining relevant tokens through market purchases and over-the-counter channels. The article does not state how much came from each funding source.

Binance said users would not lose money over the breach. The commitment depends on the exchange having enough accessible resources and completing the recovery process. Alongside funding compensation, Binance was freezing assets, restoring withdrawals in phases and preparing an updated Proof of Reserves report so users could check assets backing their balances.

After a major breach, pausing withdrawals gives an exchange time to investigate, secure affected systems and prevent further unauthorised transfers. For users, the immediate consequence is that they may be unable to move cryptocurrency off the platform. This can create uncertainty, even when account balances and other services remain visible or usable.

Binance targeted a phased restoration of withdrawal services within approximately 34 hours. The timeline depended on completing security checks. Deposits and other platform services unaffected by the breach continued operating. This shows the exchange was not necessarily shutting down its entire platform; it was restricting a specific function while examining the incident.

The pause also gives investigators time to coordinate with law enforcement, blockchain intelligence firms, asset issuers and industry partners. Binance was buying replacement assets and freezing stolen funds at the same time. It planned to publish an updated Proof of Reserves report by Monday, November 2. Further technical findings were expected within about 48 hours, subject to verification.

Blockchain transactions create records that investigators can follow from one wallet to another. When stolen cryptocurrency reaches a wallet or service that can be identified, partners may flag the funds and act to restrict movement. This does not mean every asset can always be stopped, but it can make stolen funds harder to use or convert.

Binance said it had frozen approximately $3 billion of stolen assets across blockchain networks. The effort involved law enforcement agencies, blockchain intelligence firms, asset issuers and industry partners. Binance was also buying remaining relevant tokens through market and over-the-counter channels. These actions use two different routes: stopping identified funds where possible, and replacing or recovering assets through purchases.

The article does not provide the technical addresses, specific issuers or exact freezing procedures. It says the investigation remained ongoing and that additional technical findings were expected within approximately 48 hours, subject to verification. Binance also planned a detailed report explaining how the breach happened and which security measures would follow.

Cryptocurrencies are digital assets whose ownership and transfers are recorded on blockchains. A blockchain is a shared, tamper-resistant record maintained across a network. Instead of moving physical coins, users make digital transactions that update the recorded balance associated with wallet addresses. This matters because the record, rather than a bank account or physical token, defines the asset’s movement.

Private keys are secret credentials used to authorise transactions. A user who controls the relevant private key can generally instruct the network to spend assets from that wallet. Other participants verify the transaction against the blockchain’s records. In Binance’s case, attackers made unauthorised withdrawals from hot wallets. The exchange said it found no evidence that private keys had been leaked, so its investigation examined other intrusion points.

The blockchain record can help investigators trace stolen assets after they move between wallets. Binance said it froze approximately $3 billion through coordination with partners. However, the article does not explain the underlying blockchain technology in detail. It does show why access controls, transaction monitoring and secure wallet operations matter for digital-asset exchanges.