Markets · Markets
Binance pauses withdrawals after attack, says it will cover all losses
The exchange halted withdrawals Thursday evening for security checks, says it has frozen about $3 billion of affected assets and now reports more than one point of breach.
Binance halted customer withdrawals on Thursday evening, saying at 6:33 p.m. ET that its team was "conducting security checks" and that "Withdrawals will resume as soon as the security issue is fully resolved" [1]. Within the next two and a half hours it said it had frozen $2.54 billion, then about $3 billion; by its later account, these are "affected assets" that it worked with blockchain partners to freeze, held "frozen on-chain" [2][4][5]. At 8:13 p.m. ET it said: "Binance will cover all losses" [3]. Only at 10:24 p.m. ET did it offer a first explanation, a compromised engineer's laptop [5]. At 12:36 a.m. ET it said deposits were working normally and withdrawals should resume "within 48 hours" [6]. At 4:47 a.m. ET, its latest word, it said it was "on track" to resume withdrawals "in 45 hours," and that its investigation "has uncovered additional points of breach" [7].
The mechanism
Binance's first account, posted at 10:24 p.m. ET and edited a minute later, said the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions" [5]. A DevOps engineer runs the systems that keep the exchange's software working. A service container is a sealed piece of that software that does one job, here apparently handling withdrawals. If an attacker controls the machine that can talk to it, the attacker can ask the exchange to send money out, and the exchange's own systems will do it.
The same post said: "We have found no evidence of any wallet private key leak" [5]. A private key is the secret that controls a crypto wallet. Its absence matters. A leaked key lets an attacker move funds at will and forces an exchange to rebuild its wallets from scratch. Abusing a withdrawal service is a different failure, and one that pausing withdrawals can stop. Binance said as much at 4:47 a.m. ET: "The outflows ceased when we paused withdrawal service earlier" [7].
The post also put a size on the damage: "The estimated total impact sits at around $6.3B" [5]. Binance did not say how it reached that number or what it counts as impact. It said losses will be covered "from the SAFU fund and the company's funds" [5]. SAFU is Binance's user-protection reserve fund.
The evidence
Binance's own posts show a company revising its account as it went (Figure 1). At 5:15 p.m. ET it said it was "aware of reports of a potential security issue." Edited three times by 5:29 p.m. ET, that post ended on "User funds are completely safe" [8]. The 6:33 p.m. ET post addressed withdrawals only [1]. At 8:13 p.m. ET it widened the stop: "all deposits and withdrawals are temporarily suspended" [3]. By 12:36 a.m. ET it said deposits "continue to operate as normal" [6], and the 4:47 a.m. ET update said withdrawals were "still on track towards the expected timeline to resume the withdrawal service in 45 hours" [7].
| Date | Time (ET) | What Binance said | Post ID |
|---|---|---|---|
| Oct. 29 | 5:15 p.m. | "aware of reports of a potential security issue" (edited three times to 5:29 p.m.) | 2115915483832832425 |
| Oct. 29 | 6:33 p.m. | Security checks; "Withdrawals will resume as soon as the security issue is fully resolved." | 2115935002139742437 |
| Oct. 29 | 7:06 p.m. | Binance Alpha trading "temporarily suspended" | 2115943482204574108 |
| Oct. 29 | 7:22 p.m. | "current verified total frozen is $2.54 billion" | 2115947325617299903 |
| Oct. 29 | 8:13 p.m. | "Binance will cover all losses"; all deposits and withdrawals suspended | 2115960292115124558 |
| Oct. 29 | 8:52 p.m. | "current verified total frozen amount is around $3 billion" | 2115970069696217576 |
| Oct. 29 | 10:24 p.m. | Initial finding: "compromised DevOps engineer's laptop" (edited 10:25 p.m.) | 2115993138271756507 |
| Oct. 30 | 12:36 a.m. | Deposits "operate as normal"; withdrawals expected to resume "within 48 hours" | 2116026356740034858 |
| Oct. 30 | 4:47 a.m. | "additional points of breach"; "complex attack"; resume "in 45 hours" | 2116089661408108712 |
Source: @binance on X. Table: Le Coin.
The frozen figure rose once and then held (Figure 2). Binance put it at $2.54 billion at 7:22 p.m. ET, in a post that also rejected "differing figures circulating publicly," including $1.8 billion [2]. It said "around $3 billion" at 8:52 p.m. ET [4] and repeated that number at 4:47 a.m. ET [7]. At 10:24 p.m. ET it described the process: "We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far" [5].
| As of (ET) | Frozen ($B) | Binance's wording |
|---|---|---|
| Oct. 29, 7:22 p.m. | 2.54 | "current verified total frozen" |
| Oct. 29, 8:52 p.m. | ~3.0 | "current verified total frozen amount is around $3 billion" |
| Oct. 29, 10:25 p.m. | ~3.0 | "~$3 billion frozen on-chain so far" |
| Oct. 30, 4:47 a.m. | ~3.0 | "have frozen around $3 billion thus far" |
Frozen means affected assets Binance says it and partners have locked on-chain. It is not a theft figure. Source: @binance on X. Table: Le Coin.
Markets had already started to slide before Binance said anything (Figures 3 and 4). BNB, the token Binance issues, fell from $744.12 at 4 p.m. ET to a low of $683.32 at 8:30 p.m. ET, down 8.2%. It stood at $701.91 at 6:05 a.m. ET. Bitcoin fell from $80,769 to $76,487 at 10:05 p.m. ET, down 5.3%, and was at $77,472 at 6:05 a.m. ET [9]. Both declines began around 4:30 to 4:45 p.m. ET, before Binance's first post at 5:15 p.m. ET. CoinMarketCap's published figures, which include a small share of non-crypto contracts, show $591.8 million in borrowed-money bets forced closed in the hour to 5:19 p.m. ET and $980.3 million over 24 hours [10]. Those closures came before the 6:33 p.m. ET post. The timing does not show what caused them.
| Measure | Oct. 29, 4 p.m. ET | Low (time ET) | Oct. 30, 6:05 a.m. ET | 4 p.m. to low |
|---|---|---|---|---|
| BNB price, US$ | 744.12 | 683.32 (8:30 p.m.) | 701.91 | -8.2% |
| Bitcoin price, US$ | 80,769 | 76,487 (10:05 p.m.) | 77,472 | -5.3% |
| Forced closures, US$ millions, to 5:19 p.m. ET, Oct. 29 | 1 hour | 24 hours |
|---|---|---|
| Published all-asset total | 591.8 | 980.3 |
| Le Coin crypto-only estimate (upper limit) | 568.4 | 875.0 |
The selling began about 4:30 p.m. ET, before Binance's first post. Sources: Powered by CoinGecko API (5-minute prices); CoinMarketCap liquidations; estimate is a Le Coin calculation. Table: Le Coin.
No regulator has commented publicly. The SEC, CFTC and FBI press feeds carry nothing on Binance, and Binance says only that it is working with "law enforcement" without naming an agency [3][11].
The objection
The case for calm is real. Binance says outflows stopped when withdrawals paused [7]. It says it found no private-key leak [5]. It has repeated the promise to cover all losses in four posts and named where the money comes from [3][5][7]. Deposits are working, which an exchange in real trouble rarely allows [6].
The tell (Le Coin's view)
Watch the gap between two numbers Binance itself published: Binance's estimate of about $6.3 billion in "total impact" and about $3 billion "frozen" [5][7]. Binance has not said whether frozen assets are part of the impact figure, how much of the rest it expects to recover, or how much SAFU now holds. It also promised "an updated Proof of Reserves," a public check that customer balances are backed by assets [5]. The 4:47 a.m. ET post replaced a single cause with "additional points of breach" and called it "a complex attack" [7]. A firm explaining a breach usually narrows its story as facts arrive. This one widened. The test is the withdrawal restart. If it comes inside the 45 hours Binance named, with the reserve report alongside, the promise holds. If the window slides, the market will price the gap.
Stop
Binance has paused withdrawals, says it has frozen about $3 billion, and says it will cover every loss. Its explanation has changed once already.
Sources
- @binance, Oct. 29, 6:33 p.m. ET, post 2115935002139742437: https://x.com/binance/status/2115935002139742437
- @binance, Oct. 29, 7:22 p.m. ET, post 2115947325617299903: https://x.com/binance/status/2115947325617299903
- @binance, Oct. 29, 8:13 p.m. ET, post 2115960292115124558: https://x.com/binance/status/2115960292115124558
- @binance, Oct. 29, 8:52 p.m. ET, post 2115970069696217576: https://x.com/binance/status/2115970069696217576
- @binance, Oct. 29, 10:24 p.m. ET (edited 10:25 p.m. ET), post 2115993361517891592: https://x.com/binance/status/2115993361517891592
- @binance, Oct. 30, 12:36 a.m. ET, post 2116026356740034858: https://x.com/binance/status/2116026356740034858
- @binance, Oct. 30, 4:47 a.m. ET, post 2116089661408108712: https://x.com/binance/status/2116089661408108712
- @binance, Oct. 29, 5:15 p.m. ET, first version post 2115915483832832425: https://x.com/binance/status/2115915483832832425 ; final edit 5:29 p.m. ET, post 2115918888429133902: https://x.com/binance/status/2115918888429133902
- Prices: Powered by CoinGecko API (https://www.coingecko.com/en/api). BNB and BTC 5-minute prices, accessed Oct. 30 about 6:10 a.m. ET.
- CoinMarketCap derivatives liquidations, retrieved 5:19 p.m. ET Oct. 29. https://coinmarketcap.com/api/
- SEC, CFTC and FBI press-release feeds, checked Oct. 30 about 6:15 a.m. ET.
Holding the Corner.
Not financial advice.