Binance has put a preliminary $6.3 billion impact estimate on the security incident behind the latest Binance hack reports. The exchange says it found unauthorized withdrawal transactions, temporarily suspended deposits and withdrawals, and will cover losses using its SAFU fund and company money.
Its October 30 security update also says approximately $3 billion in affected assets had been frozen on-chain. These are the company’s preliminary findings and commitments—not an independently audited statement of money permanently lost or reimbursements already completed.
What did Binance say happened?
Binance’s initial investigation points to a possible compromise of a DevOps engineer’s laptop. According to the exchange, that may have let an attacker reach a service container and submit unauthorized withdrawal transactions.
The wording matters: this is an early explanation, not a completed forensic report. Binance says it has found no evidence of a wallet private-key leak and will release a technical post-mortem after the facts are verified. A finding of unauthorized withdrawals and a finding of leaked private keys are different things; the statement describes the former without establishing the latter.
Does the $6.3 billion estimate mean that much is lost?
No final net-loss figure has been established in the cited update. Binance describes approximately $6.3 billion as the estimated total impact. It separately reports around $3 billion frozen on-chain through work with blockchain partners.
Frozen assets are not automatically recovered assets. Nor does subtracting one headline number from the other produce a verified loss: the scope, valuation timing and eventual access to frozen funds still matter. Earlier Reuters reporting on the incident described freezes by stablecoin issuers, underscoring why the recovery process needs to be tracked separately from gross exposure.
Are Binance deposits and withdrawals open?
In its October 30 update, Binance said deposits and withdrawals were temporarily suspended while security checks were completed. That statement did not give a confirmed restoration time. It also said the affected address authorization had been revoked and that law-enforcement and blockchain-intelligence partners were involved.
That is the status stated in the source, not a promise about when a particular transfer will become available. Customers should check the exchange’s official announcements and their own account notices rather than assume service has resumed because trading prices are still visible elsewhere.
Who says they will cover the losses?
Binance says it will use SAFU and company funds to cover all losses and says user funds are safe. CNBC’s coverage also reported the company’s loss-cover commitment.
Those statements should be attributed to Binance. They do not establish that a final loss has been calculated, that every affected balance has been reconciled, or that compensation has already been paid. The exchange says an updated Proof of Reserves will follow remediation; a promised update is not yet a published, independently verified recovery account.
What should readers watch next?
The next meaningful checkpoints are an official service-restoration notice, a technical post-mortem, a reconciled account of affected and recovered assets, and the promised reserve update. The cited statement does not establish the attacker’s identity, a final affected-user count or an audited net loss.
For now, “Binance hack” is a search phrase around a developing incident—not a substitute for those missing findings. Keep official company statements separate from blockchain estimates and social-media claims. Binance specifically asks users to rely on its official channels for updates.
This is a separate reported incident from the Coinbase–Amplitude contact-data issue, which concerned customer contact information rather than Binance’s reported unauthorized withdrawal transactions. Recovery figures and company assurances should not be transferred from one case to the other.
This developing report is based on Binance’s October 30 statement and the linked independent coverage. Figures and service status may change as the investigation progresses.
