Binance resumes withdrawals after $6.3 billion breach

What the $6.3 billion actually bought back

Binance froze all deposits and withdrawals after attackers took $6.3 billion from its wallets, then announced early on Sunday that withdrawals would resume in a phased process. In its latest update the exchange said it has covered 95% of the stolen assets and is still working to buy the remainder, which it describes as less liquid in the market and slower to source at the required scale. The company's position is that it will bear the financial impact and that the losses will not be passed on to users.

That is a balance-sheet commitment, not a technical fix. The 95% figure measures how much of the stolen value Binance has replaced, not how much of the original asset has been recovered or how the control that failed has changed. The exchange says it will publish a more in-depth incident report when its investigation is complete, so the mechanism of the loss is documented only in outline for now.

The outline is specific enough to matter. Binance said the breach originated from a compromised laptop belonging to a DevOps engineer, and that the attacker used that device to execute unauthorised withdrawals. It also said its investigation found no evidence that private keys associated with wallets had been exposed, a distinction the exchange treats as significant because private keys give direct control over the assets held.

The laptop is the custody story

A DevOps engineer's laptop is an ordinary enterprise asset, and that is what makes the disclosure worth reading. The attacker did not need a flaw in the wallet cryptography; according to Binance, a compromised endpoint was enough to execute unauthorised withdrawals. The private keys were not exposed, but the authority to move funds was reachable from a device someone used for work.

For an enterprise holding digital assets or integrating exchange APIs, the lesson sits in the access path rather than the token. The question to put to any custodian is not whether keys are held offline but what a single engineer's endpoint can authorise, and what approval sits between that endpoint and a withdrawal. Binance has not published that control design, and the promised incident report is where it would appear.

The exchange has also named an external actor. Binance previously blamed North Korea hackers for the breach, and on Saturday the FBI said a North Korean group known as TraderTraitor was responsible and was converting the assets primarily into Ethereum, with further laundering likely. Those are the exchange's and the Bureau's attributions, reported as such; they do not change what a buyer should ask about their own access paths.

The withdrawal freeze was the second decision

Binance said it did not make the freeze lightly, citing how important reliable access to withdrawals is for users, and called it a necessary precaution while teams contained the incident loss, assessed impact, restored services and completed security checks. That is a defensible sequence and also an admission that the exchange could not promise normal service while it worked.

Resumption is phased by network and asset type rather than switched on at once. On Sunday morning the network status page showed a mix of normal, partially suspended and fully suspended states, with Bitcoin withdrawals and deposits still partially suspended and Ethereum deposits normal while withdrawals were partially suspended. Users were told to expect temporary delays or longer processing times because of traffic volume.

The liquidity number is the one to hold on to. Between 06:00 and 15:30 Coordinated Universal Time, Binance says it processed $4.6 billion in withdrawals and $1.0 billion in deposits, a net outflow of $3.6 billion, or 2.1% of total assets under management. A run that size absorbed in a working day is the operational test the freeze was protecting against, and it is the figure a treasury team should compare with its own exposure.

What the disclosure still does not say

No total cost figure has been published. The 95% coverage is a proportion of stolen assets, the $6.3 billion is the estimated impact, and the $3 billion frozen with industry partners is a recovery figure reported at disclosure. How those reconcile against Binance's own funds is unpublished, and it is the number a counterparty would want before treating the exchange as a place to leave balances.

The timing of the incident report is also unpublished. Binance has committed to strengthening safeguards and completing the recovery process, but the controls that would stop a repeat of a compromised engineer laptop are described only as work continuing. Until the report lands, the honest reading is that the loss was contained and reimbursed, not that the cause was closed.

The market reaction is documented too. Bitcoin fell sharply after the announcement, and Ether, Binance's BNB token and several cryptocurrency-related stocks recorded significant declines. That is the counterparty exposure in one sentence: an incident at one exchange moved prices across the sector before the recovery was complete.

Who should walk away

An enterprise that treats an exchange balance as a treasury account should walk away from that habit. The 2.1% net outflow in a single day shows how quickly a venue's liquidity and its users' confidence move together, and the 95% coverage is a promise backed by the exchange's own funds rather than by an insurance policy the reader can inspect.

A team that cannot answer what a single engineer's endpoint can authorise on its own custody integration should walk away from the integration until it can. Binance's disclosure puts the entry point at a DevOps laptop, and the same question applies to every API key and withdrawal permission an enterprise holds on any venue.

A buyer who needs a published incident report before signing should wait for the one Binance has promised, and ask for the date. The exchange has covered most of the loss and reopened the door; it has not yet shown the control that keeps the next laptop from mattering.