Binance is conducting a comprehensive review of its digital-asset operations following a security breach involving unauthorized access to hot wallets. The company has confirmed that the majority of customer funds are held in cold storage and are not affected by the incident, with assets primarily moving to hot wallets only upon request for withdrawals.

Details of the Incident

Investigators traced the compromise to a compromised laptop that provided initial access points. Further entry points were identified, revealing that multiple individuals were involved in the operation. Attackers employed a self-destruct mechanism to eliminate tools and traces, which has made tracking more challenging. They also utilized EIP-7702 to obtain on-chain execution authorization for one hot wallet, bypassing standard approval processes.

The breach resulted in the theft of funds from 15 wallets spanning eight blockchains, including Ethereum, Bitcoin, TRON, Arbitrum, Avalanche, Optimism, Base, and Polygon. Binance has stated that it will cover the stolen amounts using company funds. More than $6.34 billion in reserves are already reserved for this purpose, with $5 billion in affected assets and the remainder sourced through market purchases and over-the-counter transactions.

Operational Impact and Customer Status

Deposits continue to operate without interruption, allowing users to add funds as normal. Withdrawals, however, remain suspended while the company implements upgrades to the service and associated address controls. He Yi has indicated that restoration efforts are expected to commence within 48 hours, with a target of Nov. 1 as the point when service should be available again, though this remains contingent on completing rigorous security testing.

Richard Teng has noted that withdrawals could potentially return within about 40 hours, depending on the timeline of the ongoing reviews across endpoints, cloud services, key management, and transaction-signing systems.

Reserve Reporting Schedule

Binance plans to release a complete proof-of-reserves report on Nov. 2, providing full verification of asset holdings. Preliminary figures may be shared sooner to give users greater transparency during the recovery period. This report follows the recent attack and serves to reaffirm the company's commitment to transparency and customer protection.

The company is rebuilding withdrawal services from the ground up to ensure they meet the highest security standards before any resumption. Customers are advised to monitor official channels for the latest updates as the process progresses.