Key Takeaways
- Binance said $5 billion was already held in the affected cryptocurrencies.
- About $3 billion in stolen assets had been frozen, the exchange reported.
- Binance co-CEO Richard Teng said the attacker bypassed normal approval controls.
Saylor Sees Lessons From Binance Security Failures
Strategy Inc. (Nasdaq: MSTR) Executive Chairman Michael Saylor said on Oct. 30 that the crypto industry would improve its defenses following Binance’s estimated $6.3 billion hack. In his assessment of Binance’s response, shared on X, he stated:
“Binance has committed its own balance sheet to making customers whole. I expect it to deliver. Our industry will learn from this incident, strengthen security, and emerge stronger and more resilient.”
The exchange’s official security update, also dated Oct. 30, placed the hot-wallet compromise at approximately 8:05 p.m. UTC on Oct. 29. Binance pledged coverage through its corporate treasury and Secure Asset Fund for Users, or SAFU, an emergency fund to protect user assets. The company said investigators had uncovered breach points beyond the initially suspected compromised laptop and found no evidence that wallet private keys were leaked.
Saylor’s remarks followed Strategy’s record third-quarter results, announced Oct. 29, which included $20.91 billion in operating income and $44.75 in diluted earnings per share. The company held 848,517 bitcoin as of Oct. 25, up 26% year to date. Saylor said a new bitcoin bull market was beginning, citing growing institutional demand and banks’ adoption of bitcoin.
Company Funds Back Asset Replacement
More than $6.34 billion in company funds had been reserved for the incident, according to Binance. Of that amount, $5 billion was already held in the affected cryptocurrencies, while purchases through market and over-the-counter channels were intended to fill remaining shortfalls. Limited liquidity in some tokens and settlement times could slow those purchases, the company said.
Separately, Binance reported approximately $3 billion in frozen stolen assets, distinct from its replacement funds, as it pursued recovery with law enforcement and industry partners. Its withdrawal recovery plan targeted a phased restart within approximately 34 hours of the Oct. 30 update, subject to completed security checks. Updated proof-of-reserves results were planned by Nov. 3.
Security Review Examines Devices and Transfer Approvals
Co-CEO Richard Teng described an expanded security investigation in a video shared on Oct. 30, saying the attacker bypassed normal approval controls and used a self-destruct mechanism to erase tools and traces. The companywide review covered endpoints, such as employee computers connected to its network, along with cloud infrastructure and key management. It also examined transaction-signing systems that authorize cryptocurrency transfers.
Most customer assets were held in cold wallets, with transfers into hot wallets supporting withdrawals, Teng said. Offline private-key storage keeps keys disconnected from the internet, while exchange-held cold wallets remain under the provider’s custody. Binance also planned a technical postmortem, a detailed review of how the attack occurred and the safeguards being implemented.
