Michael Saylor, executive chairman of Strategy Inc., stated on October 30 that the crypto industry would strengthen security following Binance's estimated $6.3 billion hack. In a statement shared on X, Saylor said: "Binance has committed its own balance sheet to making customers whole. I expect it to deliver. Our industry will learn from this incident, strengthen security, and emerge stronger and more resilient."
Binance's security update, also dated October 30, indicated the hot-wallet compromise occurred at approximately 8:05 p.m. UTC on October 29. The exchange pledged to cover the incident through its corporate treasury and its Secure Asset Fund for Users, or SAFU, an emergency fund designed to protect customer assets. Investigators found no evidence that wallet private keys were leaked and uncovered breach points beyond the initially suspected compromised laptop.
Funding and Asset Recovery
More than $6.34 billion in company funds were reserved for the incident. Of that amount, $5 billion was already held in the affected cryptocurrencies, with the remainder to be obtained through market and over-the-counter purchases. Binance separately reported approximately $3 billion in frozen stolen assets as it worked with law enforcement and industry partners on recovery efforts.
The exchange targeted a phased withdrawal restart within approximately 34 hours of the October 30 update, pending completion of security checks. Updated proof-of-reserves results were planned by November 3.
Security Investigation Details
Co-CEO Richard Teng described an expanded security investigation in a video released on October 30. According to Teng, the attacker bypassed normal approval controls and used a self-destruct mechanism to erase tools and traces. The companywide review covered employee computers and cloud infrastructure, along with key management and transaction-signing systems that authorize cryptocurrency transfers.
Most customer assets are held in cold wallets, with transfers into hot wallets supporting withdrawals. Binance planned a technical postmortem to examine how the attack occurred and review the safeguards being implemented.
