Binance says October breach affected $6.34 billion in crypto

Binance says a security breach on Oct. 29 affected about $6.34 billion in digital assets, raising questions about how attackers reached its wallet systems and moved funds. The exchange says it will cover user losses. Its initial findings report gives a fuller account than Binance’s first update, which the Associated Press reported as the exchange investigated a potential security issue.

Binance said on Nov. 3 that about $2.85 billion had been frozen or intercepted, subject to reconciliation and changes in market prices. It also said it had set aside more than enough to cover the loss. By Oct. 31, it said, 98% of affected token assets had been replenished and could be checked against its Proof of Reserves, a record of assets held to back customer balances.

How did attackers move funds from Binance wallets?

Binance says attackers gained access to an internal service used to approve wallet transactions, then sent withdrawals outside the usual process. Between 20:05 and 20:09 UTC on Oct. 29, five Binance hot wallets—online wallets used to move funds—sent 233.46 million XRP to an attacker-controlled address.

Binance also reported transfers of about 970,500 SOL and 44.2 million OP from wallets on Solana and Optimism, followed by 18,270 BTC from a Binance hot wallet. The attacker then used Ethereum’s EIP-7702 authorization feature to give a smart contract, a program on the blockchain, partial control over a Binance wallet.

Why did stopping withdrawals not end the transfers?

Binance says those on-chain permissions could keep working outside its normal withdrawal system. The exchange suspended withdrawals and tried to revoke the permissions, but its multi-party wallet setup required a special process to do so. Binance says the last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC. It cleared the wallet’s delegation code at 00:10 UTC on Oct. 30 and saw no further unauthorized transfers.

The exchange’s first update had pointed to a possibly compromised engineer’s laptop and said there was no evidence that wallet private keys had leaked. Its Nov. 3 report describes a wider, multi-stage attack involving social engineering, malicious software and compromised internal tools. Binance says it has closed the identified entry points, rebuilt affected systems and is engaging independent security firms to review the incident.

The investigation is ongoing. Binance says it will publish more findings after further review, while keeping some technical details confidential. It says affected users will not bear the financial loss.

Sources

• initial findings report — binance.bh
• reported as the exchange investigated a potential security issue — apnews.com