Binance suspends deposits and withdrawals while loss estimates stay unsettled

Binance has temporarily suspended deposits and withdrawals while it investigates a security incident. In a preliminary update, the exchange estimated the total impact at around $6.3 billion and said about $3 billion had been frozen on-chain with blockchain partners. The notice gave no date for reopening deposits and withdrawals. It is a vendor account, not an independent audit, and a detailed technical post-mortem is still pending.

Binance’s notice and Bloomberg’s reporting both refer to deposits and withdrawals. Neither says that all trading or every account function stopped, and the available reporting does not establish that trading halted.

Reports on 29 October described billions of dollars in assets leaving Binance hot wallets, a suspected hack and freezes by stablecoin issuers. Bloomberg reported that digital tokens fell as the incident raised fears of a major crypto heist. Binance’s own update, dated 30 October, set out a possible cause and a loss-coverage pledge. The early reports and the later company statement were answering different questions.

What Binance has confirmed

Binance said its initial investigation suggested that a compromised DevOps engineer’s laptop may have allowed an attacker to access a service container and submit unauthorised withdrawal transactions. It said it had found no evidence of any wallet private key leak. Those statements are preliminary, and the precise method had not been confirmed. The exchange also said it had revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners to trace and recover funds.

Binance described user funds as safe and said it would cover all losses from its SAFU fund and company funds. Those assurances have not been independently verified, and the exchange had not explained how it would fund the pledge.

Why the loss figures do not line up

Public estimates range from at least $1.7 billion to about $6.3 billion. They are not competing versions of one audited loss. They describe different things measured at different times.

An early Wall Street Journal report said hackers appeared to have taken at least $1.7 billion, and that analysts thought the figure could be higher. BleepingComputer, writing on 29 October, described a potential exposure of up to $5.8 billion. It also reported that Arkham Intelligence was tracking 55 addresses holding about $5.78 billion in assets, while noting that this was the value of the tracked wallets rather than a confirmed amount stolen.

Chainalysis put the stolen amount at about $5.912 billion, an estimate reported by CoinDesk and relayed by investingLive. Binance’s own figure was around $6.3 billion in total impact. That wording is broader than a stolen-asset figure, and the exchange presented it as an estimate rather than an audited loss.

Changpeng Zhao, Binance’s founder, had suggested a loss after freezes of slightly over $1 billion, while on-chain reviews focused on about $3.3 billion leaving Binance’s Ethereum hot wallets, investingLive reported. Chainalysis had not published a breakdown, and Binance had not confirmed a final loss figure when that article appeared.

The range is therefore better read as a chain of partial measurements: early reported theft, potential exposure, tracker holdings, an analytics estimate and a company impact estimate. None is a final audited loss, and the published accounts do not offer comparable methodologies.

Freezes are not recoveries

Binance’s notice said about $3 billion had been frozen on-chain. investingLive cited Binance at $2.54 billion, while BleepingComputer reported issuer freezes of more than $1.567 billion in USDT by Tether and more than $800 million in USDC by Circle. Those amounts may overlap and may reflect different moments.

A freeze blocks movement. It does not return tokens to Binance or establish a recovery. investingLive noted that returning frozen assets through issuers or courts typically takes weeks. That distinction is central to the coverage pledge: the exchange has promised to absorb losses, but the money has not come back yet.

Binance said it would draw on SAFU and company funds. investingLive put SAFU at roughly $1 billion in bitcoin and reported that the exchange had not said how it would fund the pledge. On Binance’s own figures, the frozen total is less than half its estimated impact, which leaves a large balance-sheet question even if some assets are eventually returned.

Cause and culprit remain open

Binance’s preliminary account points to a possible compromised laptop and access to a service container. Blockaid’s Ido Ben-Natan, in remarks reported by Cointelegraph through a syndicated CoinMarketCap post, described a preliminary assessment of key misuse or compromised signing infrastructure, rather than a leaked private key. Binance had not confirmed the method.

Ben-Natan said the activity resembled operations linked to North Korean cyber attackers, based on the sophistication of the on-chain preparations. That is a resemblance assessment, not a formal finding. investingLive reported that no agency or analytics firm had attributed the incident to any group at the time of its article. The absence of attribution is not proof that no actor was involved; it means the published record did not name one. Binance said it was working with law enforcement to confirm the identity of those responsible, and no named suspect had emerged in the supplied reporting.

What customers should watch

Binance’s practical message has been narrow: use official channels, avoid unofficial links and messages, and do not respond to requests for account information. It warned customers about scams as the incident developed.

Several questions remain open. Binance has not published a final audited loss, a completed technical post-mortem, a reopening date or a confirmed attribution. It has promised an updated Proof of Reserves after remediation, but that may address backing without explaining the cause or settling the figures. The available reporting did not establish any customer-data access or Australia-specific impact.

For customers, the immediate position is constrained: withdrawals are paused, the coverage pledge is untested and the official account remains preliminary. Until Binance publishes the promised post-mortem, an audited loss figure and a reopening date, the incident is acknowledged in outline but unmeasured in detail.

Suppose the wallet keys stayed put yet a withdrawal was still authorised: where exactly does the boundary of signing authority sit, and what would evidence of misuse actually look like? That is the question Binance’s preliminary account leaves open, and it is where cryptography stops being an abstraction about ciphers and becomes a practical study of keys, signatures and the infrastructure trusted to use them. Learning how a signature can prove authorisation without exposing a key, and why revoking an address authorisation is a separate step from establishing what went wrong, builds the habit of asking what each line of an incident notice really settles. A structured place to build that understanding is The Hack Academy’s online cybersecurity training programme, which lists cryptography among its subject areas and sets self-paced learning and practical exercises alongside the theory.