UPDATE: Binance Withdrawals Remain Paused After $6.3bn Hack, $3bn Frozen

UPDATE Binance withdrawals remain paused as the exchange works through security checks following the theft of about $6.3 billion from its hot wallets. Binance says deposits and other unaffected services are operating, about $3 billion in assets has been frozen on-chain, and it plans a phased return of withdrawals once systems are cleared.

This is a follow-up to Waves Times’ initial report on the record-scale breach. The key development is the exchange’s latest service position: Binance withdrawals are temporarily unavailable, but Binance says deposits and other unaffected platform services remain operational. That is different from a full halt to all transactions or trading across the platform.

What is operating and what is paused

Binance says the attack involved unauthorised withdrawals from hot-wallet infrastructure on October 29. Hot wallets are connected to the internet and used for operational transfers, unlike cold wallets that are usually held offline. The company has revoked affected authorisations, contained the compromised infrastructure and introduced additional controls while investigators review the incident.

For now, Binance withdrawals are the service most directly affected. The exchange says it is carrying out further reviews, applying remediation measures and validating the integrity of systems before withdrawals return. Its target is a phased restoration, meaning individual assets or networks may reopen at different times rather than everything returning at once.

Binance’s wording has evolved as it learned more. Its earliest update referred to both deposits and withdrawals being suspended as a precaution. In its later statement, it said deposits and other unaffected services were operating normally while the withdrawal service remained paused. Readers should use the latest official notice, not old social-media screenshots, when deciding whether a service is available.

Frozen assets and loss cover

The exchange puts the total impact at about $6.3 billion. It says partners including law enforcement agencies, asset issuers, blockchain-intelligence firms and other industry participants have frozen approximately $3 billion on-chain. That amount could change as investigators trace transfers and establish which addresses are connected to the theft.

Binance says it will cover losses through its Secure Asset Fund for Users and company resources. It has said more than $6.34 billion in company funds has been set aside, including about $5 billion already held in the affected token assets. The company plans an updated proof-of-reserves snapshot to help users assess the backing of customer balances after the recovery work.

Investigation and attribution

The initial Binance explanation suggested a compromised DevOps engineer’s laptop may have given an attacker access to a service container used to submit unauthorised withdrawal transactions. The company now says it found additional potential breach points and has not reported evidence that wallet private keys were leaked.

Blockchain intelligence firm TRM Labs has attributed the operation to TraderTraitor, a North Korea-linked group associated with Lazarus Group, citing on-chain and off-chain intelligence. That is the firm’s assessment, not a final public finding from Binance or law enforcement. Binance has said it is working with authorities to identify those responsible.

What users should do now

Users should not trust messages claiming they can “unlock” Binance withdrawals or recover funds in return for a fee. Avoid links from unsolicited emails, direct messages and fake support accounts. Binance will not need a customer’s seed phrase to resolve this incident.

For verified changes, check Binance’s official security update. The important point for customers is that Binance withdrawals are still being restored, not permanently closed, and the timeline remains subject to the company’s security checks.