Tech brief Breaking

Binance Says Hack Hit About $6.3 Billion: Withdrawals Still Paused, What Users Should Do

By , Tech Cheat Codes Team

Published Updated 7 min read

Illustration: a phone exchange app with gold coins and a grayed-out withdraw button marked with an hourglass, under a broken-open padlock.
Image: Illustration: Tech Cheat Codes
On this page · 6 sections
  1. What happened
  2. Who's affected
  3. Will you get your money back?
  4. What to do if you use Binance
  5. What we still don't know
  6. References

Binance put a number on it overnight. Binance, which BBC calls the world's biggest crypto exchange, says the hack it suffered on Thursday had an estimated total impact of about $6.3 billion. If that figure holds, it would be the largest crypto theft on record. Binance also says about $3 billion has been frozen so far with help from blockchain partners, and that it will cover all losses out of its SAFU emergency fund and its own money.

If you keep crypto on Binance, here's where things stand Friday morning. Binance says deposits are operating as normal. Withdrawals are still paused, and Binance says it's on track to resume them in 45 hours, per its 4:47 AM ET update. Binance hasn't given a clock time. If the 45 hours count from that post, that's around 1:47 AM ET Sunday, by our math. Binance.US, the separate American exchange, says it wasn't affected.

What happened

Before Binance confirmed a security issue on Thursday, BBC reports, several crypto industry observers had flagged concerns about a possible hack. At 6:15 PM ET Binance posted that its team was running security checks and that withdrawals would resume once the security issue was resolved. By 8:13 PM ET it said all deposits and withdrawals were suspended while it ran security checks. Binance says the outflows stopped once it paused withdrawals.

At 10:25 PM ET, Binance shared what its first look had found. The attack may have started with a compromised laptop belonging to one of its DevOps engineers, the staff who run its internal systems. Binance says that may have given the attacker access to a service container, a piece of Binance's own software, where they sent through withdrawals that hadn't been authorized. Binance says it found no evidence that any wallet private key leaked.

Early Friday the story got more complicated. Richard Teng, Binance's co-CEO, posted at 3:37 AM ET that the attacker did not simply use one engineer's permissions, that it wasn't a single "one-click" action but a more complex attack, and that the investigation hasn't attributed responsibility to any individual. At 4:47 AM ET, Binance said its later investigation had uncovered additional points of breach beyond the laptop and that it's working with law enforcement. It hasn't named who was behind the attack.

Binance says it revoked the authorizations on the affected addresses and is working with law enforcement and blockchain intelligence partners to trace and recover funds. Engadget reports that Circle, the company behind the USDC stablecoin, said it froze about $800 million in funds tied to the attack, and that Tether said it froze funds too.

Who's affected

Customers of the main Binance.com exchange are the ones waiting. Binance says deposits are operating as normal, but withdrawals remain paused while it completes a security revamp of the withdrawal service and its related addresses. At 12:36 AM ET it said it expects to resume within 48 hours, and at 4:47 AM ET it said it was still on track to resume the withdrawal service in 45 hours. Binance hasn't given a clock time. If the 45 hours count from that 4:47 AM ET post, that's around 1:47 AM ET on Sunday, Nov. 1 (just before clocks go back an hour), by our math. That's our estimate, not a time Binance has promised, and it could move.

Binance.US is a separate company with its own platform, and it said Thursday that it wasn't affected and that its services were running normally. BBC describes Binance.US as the platform that provides trading services specifically for American residents, so many US users are on it rather than the main exchange. If you aren't sure which one you have, check the web address you log in at or the app's name on your phone.

The wider crypto market fell too. BBC reports Bitcoin dropped by more than 4% after the first alerts, and that Ethereum and Solana also fell sharply, so a coin you hold somewhere else may be worth less than it was before the news.

Will you get your money back?

Binance says it will cover all losses. Its official line is that user funds are safe and that the money will come from the SAFU fund and company funds. SAFU is short for Secure Asset Fund for Users. Binance also says it will publish an updated Proof of Reserves once remediation is complete. That's a public report meant to show the exchange holds enough assets to match what customers have on the platform.

That pledge is a statement from the company, and we haven't seen anyone outside Binance confirm it in the sources we read. By Binance's own figures, about $3 billion of its estimated $6.3 billion impact was frozen as of its 4:47 AM ET update, close to half. Binance has repeated the pledge to cover losses in several updates since Thursday night, including its 10:25 PM and 4:47 AM ET posts.

What to do if you use Binance

You can't speed anything up, but you can keep from making things worse while you wait.

  1. Don't try to work around the pause. Anyone who offers to "unlock" your withdrawal, get you to the front of the line or move your coins for a fee is almost certainly running a scam.
  2. Get updates only from the official Binance app, binance.com and Binance's verified X account. Binance has told customers to rely only on official Binance channels.
  3. Ignore any email, text, call or direct message claiming to be Binance support or offering a "refund" or "compensation" for the hack. Scammers often target people after big hacks. Never give anyone your password, two-factor codes or recovery phrase.
  4. Take a screenshot of your balances now. If anything looks off once withdrawals come back, your own record helps.
  5. Binance says deposits are working, but anything you send in now can't be withdrawn until withdrawals reopen. Keep that in mind before you add funds.
  6. If you used the same password for Binance anywhere else, change it on those other sites. Binance hasn't said customer passwords or accounts were affected, but it's a cheap precaution.

When withdrawals reopen, it's possible many people will try to withdraw at the same time, and there could be delays at first. That alone wouldn't mean something new went wrong.

What we still don't know

Binance hasn't explained the full attack path or what the additional points of breach were. It hasn't said whether any customer personal information was involved, though nothing in the statements we read points to customer accounts being the target. It also hasn't said exactly when and how it will settle the part of the loss that isn't frozen. It plans to publish a detailed technical report once its investigation is finished.

For now, the steps in your control are watching the official Binance channels and not answering anyone who contacts you first.

References