Binance Reports $6.3 Billion Hot-Wallet Theft as Bitcoin White Paper Turns 18

Eighteen years after Bitcoin was proposed as cash that could move without a trusted intermediary, Binance is responding to unauthorized hot-wallet withdrawals it says began October 29. The exchange reported approximately $6.3 billion in stolen digital assets, putting centralized custody and the limits of emergency asset freezes under fresh scrutiny.

The October 31, 2008, cryptography mailing-list announcement described an electronic payment system that would not require a trusted financial institution. The anniversary now coincides with a test of the businesses that hold digital assets on users' behalf. The reported breach involved an exchange's wallets, not an established failure of Bitcoin's underlying consensus mechanism.

A Theft Measured Across Blockchains

Binance's figure is not a final audited loss. TRM Labs traced approximately $6.36 billion across 10 blockchains, including 18,270 bitcoin. Elliptic calculated about $6.43 billion across 11 blockchains. Both firms identify a multichain theft, but their counts and valuations differ, and their published analyses do not fully reconcile the gap. The figures should not be treated as interchangeable or as an all-bitcoin loss.

The investigation also points toward an operational failure around transaction authorization, although the full intrusion route is unresolved. TRM assessed that Binance hot-wallet signing infrastructure was compromised. In its October 30 security update, Binance said a potentially compromised laptop appeared in its preliminary findings, but investigators subsequently identified additional breach points. The company said it had found no evidence of leaked wallet private keys. That statement does not establish how every unauthorized transaction was approved.

Attribution remains another boundary. Elliptic assessed that North Korea's TraderTraitor group was likely responsible, while TRM also attributed the attack to that group. These are private investigators' assessments, not government confirmation of responsibility for the October 29 incident.

The Custody Trade-Off Behind the Freezes

The response reveals a different type of control. Elliptic said it had verified approximately $2.85 billion in frozen or seized assets, largely involving stablecoins. Binance separately said approximately $3 billion had been frozen. Frozen or seized does not mean returned to the exchange or reimbursed to customers. The ultimate unrecovered amount remains uncertain.

Those interventions illustrate the difference between native cryptocurrencies and tokens subject to issuer or network-level restrictions. According to Elliptic's analysis of the freezes and remaining assets, some stolen holdings could be blocked through centralized controls while others could not. Such powers can help contain theft, but they also show how forms of financial control persist around systems designed to reduce dependence on intermediaries. That distinction is about custody and token governance; it is not evidence that Bitcoin's protocol itself was breached.

There is no risk-free alternative. The SEC's retail investor custody bulletin warns that third-party custodians can be hacked or fail, potentially cutting investors off from their assets. Self-custody removes that intermediary but shifts protection of private keys to the owner; lost or stolen credentials can mean permanent loss of access. Control and responsibility move together.

The market response has so far been more limited than the theft's size might suggest. Reuters reported declines in cryptocurrency prices and shares of U.S.-listed crypto-related companies, including Coinbase, Strategy and Robinhood, but said broader crypto-price losses remained contained. The available reporting does not establish a wider banking-system disruption or an inevitable exchange collapse.

The Test Is Restoration, Not a Promise

Binance says it will absorb customers' losses through company resources and its protection fund. In the company statement outlining its funding commitment, it reported setting aside more than $6.34 billion in company funds, including approximately $5 billion already held in corresponding stolen token types, while buying replacements for the remainder. That is a company representation, not independently verified proof that balances have been restored or customers fully repaid.

The operational interruption is also measurable. Binance said it had suspended withdrawals and planned a phased resumption, initially targeting a restart within approximately 34 hours, subject to security checks. It also set November 2 as the target for publishing results from an initial proof-of-reserves snapshot. An announced target is not a completed restoration or an independently assessed reserve verification.

For now, the strongest counterweight to a collapse narrative is Binance's stated funding commitment, the assets independently identified as frozen or seized, and the contained market reaction. None settles the final recovery total, the intrusion path or the condition of withdrawal operations. The next concrete tests are whether withdrawals resume safely, customers are made whole and the promised reserve information can be independently assessed.