Binance plans to resume withdrawals within 48 hours

Binance expects to restore withdrawals within 48 hours while it completes security checks, updates its withdrawal service and reviews related wallet addresses. Deposits are operating normally, the exchange reported on Oct. 30.

The exchange’s initial investigation identified a compromised laptop used by a DevOps engineer as a possible entry point. The breach may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Binance found no evidence that wallet private keys were leaked.

Cybersecurity firms have suggested that the attacker may have misused the system that signs transactions. That could allow unauthorized transfers without exposing the underlying private keys. The assessment remains preliminary, and Binance is tracing the full attack path.

Binance reported that the verified value of crypto frozen in connection with the breach had reached $3 billion as of Oct. 30. The amount may increase as investigators trace additional assets. The frozen tokens include USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and ARB.

Chainalysis estimated that $5.912 billion was stolen at the time of the attack. Its chief executive, Jonathan Levin, later estimated the theft at about $6.4 billion and said industry participants had frozen approximately $3 billion. The figures differ because investigators are still identifying and verifying assets linked to the breach.

Stablecoin issuers and crypto projects have frozen funds tied to the suspected exploit. World Liberty Financial froze $27 million in USD1 and $2 million in WLFI. Ripple froze affected RLUSD, and First Digital froze FDUSD linked to the incident. The Arbitrum Security Council transferred about $30.5 million in ARB and Ether to an intermediary frozen wallet.

Aave froze markets across its V3 and V4 deployments after the exploiter deposited $60 million in USDT and borrowed about $44.6 million in wrapped Ether. Users can withdraw funds and repay loans, while new deposits and borrowing remain blocked. The position was backed by collateral and did not put Aave suppliers at risk.

Chainalysis and Blockaid identified characteristics associated with TraderTraitor, a North Korean hacking group. Blockaid cited the transaction preparation, multiple authorizations and use of a customer sweeper contract. TraderTraitor has also been linked to the $292 million KelpDAO exploit in April.

The breach affected crypto prices on Oct. 30. Bitcoin traded near $76,937, down 4.9% over 24 hours. BNB fell about 8% to $693, and Ether declined 5.7% to about $2,211. Aave and Uniswap also fell, while the Bitcoin Fear and Greed Index dropped to 30, a level classified as fear.

Trading firms Wintermute and GSR disclosed exposure to Binance but did not expect major disruption to their operations. GSR reported exposure below 5% of net equity, while Wintermute put its exposure below 20%. Binance has pledged to cover all losses and publish a post-mortem after the investigation is complete.