Binance published its second Security Incident Update on Oct. 30, laying out a four-part recovery plan for the recent exchange hack and targeting the start of withdrawal restoration within roughly 34 hours of the announcement. The phased restart of withdrawals remained conditional on completed security checks, remediation, and validation of the affected systems, while deposits and other unaffected services continued to operate normally, according to the announcement.

Co-CEOs Yi He and Richard Teng signed the update, which placed the hot-wallet compromise at approximately 8:05 p.m. UTC on Oct. 29. Hot wallets are internet-connected wallets exchanges use to process day-to-day withdrawals, in contrast to offline cold-storage systems. Addressing the estimated $6.3 billion loss, the statement stressed that users would not bear the cost:

“Binance will absorb the financial impact of these stolen funds, not our users.”

The exchange pledged to cover losses through its Secure Asset Fund for Users (SAFU) and its corporate treasury, meaning company financial reserves. SAFU is an emergency reserve Binance established in 2018 and funds through a portion of trading fees.

Token Purchases and Onchain Freezes

Binance said more than $6.34 billion in company funds had been reserved for losses, including $5 billion already held in the affected token assets. Those holdings covered roughly 80% of the losses across assets such as $USDC, $USDT, BTC, ETH, and BNB, with purchases through market and over-the-counter channels underway to acquire the remaining matching tokens. Over-the-counter trades are negotiated directly between counterparties rather than executed on public order books.

Approximately $3 billion had been frozen onchain, Binance reported, and recovery efforts were continuing alongside law enforcement, token issuers, intelligence firms, and other exchanges. Blockchain analytics firm Elliptic's independent analysis of tracing and freezing efforts put verified freezes at $2.84 billion as of its 8 a.m. UTC update on Oct. 30, predominantly involving $USDT and $USDC. Frozen funds remained subject to ongoing recovery work.

Because stolen-asset tracing relies on public blockchain transaction records, investigators can examine wallet balances and transfers directly onchain. Separately, Binance planned an initial proof-of-reserves snapshot within 12 hours of its announcement, with results expected by Monday, Nov. 2, showing platform holdings against customer balances. Proof-of-reserves attestations became a widespread transparency practice across major exchanges following the 2022 collapse of FTX.

Investigation Points to Signing Access

Initial findings indicated that a compromised DevOps engineer's laptop enabled unauthorized withdrawal submissions. DevOps engineers maintain software deployment and the infrastructure supporting it. Binance maintained that it had found no evidence of leaked wallet private keys, the cryptographic credentials that control access to onchain funds.

In a separate Oct. 30 video, Teng described additional breach points, bypassed approval controls, and a self-destruct mechanism that destroyed tools and traces. Binance said it had contained the compromised infrastructure, revoked affected authorizations, and introduced further controls against unauthorized activity, while internal and external specialists worked to reconstruct the full attack sequence.

Blockchain security firm Hypernative's analysis identified compromised signing access and valid signatures produced from Binance-controlled keys. The firm described the use of EIP-7702, an Ethereum feature that lets a regular wallet execute smart-contract code, to run attacker-controlled code through a Binance wallet.

Binance said it expected further verified technical findings within about 48 hours of the announcement, subject to investigative considerations, to be followed by a detailed post-mortem covering the attack and the safeguards introduced in response.