Binance Finds 'Additional Points of Breach' in $6.3B Hack

Binance has uncovered "additional points of breach" in Thursday's security incident, which it estimates cost around $6.3 billion, the exchange said on Friday, after initially pointing to a compromised engineer's laptop.

In an announcement late Thursday, Binance said a compromised DevOps engineer's laptop may have allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. "We have found no evidence of any wallet private key leak," the exchange said.

Binance CEO Richard Teng said on Friday that the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action," describing "a more complex attack process." "Our investigation has not attributed responsibility to any individual," he wrote.

"This was a complex attack," Binance said in its latest update, adding that it is still gathering the facts. Outflows stopped when it paused withdrawals, and it remains on track to resume them in 45 hours, the exchange said.

About $3 billion of the affected assets has been frozen onchain with the help of blockchain partners, Binance said. The exchange said it will cover all losses from its SAFU fund, an emergency reserve for users, and from company funds, and that "user funds are safe."

Binance initially suspended deposits and withdrawals, revoked the affected address authorization, and is working with law enforcement and blockchain intelligence firms to trace and recover the funds. By Friday morning, deposits were "operating as normal," Teng said, while withdrawals remain suspended as the exchange completes "a security revamp of the withdrawal service and its related addresses."

"We'll share a detailed technical post-mortem once the investigation is complete and every fact is verified—and publish an updated Proof of Reserves once remediation is complete," Teng wrote.

Blockchain analytics firm Arkham put the haul at $6.01 billion, taken from Binance hot wallets on nine blockchains between 4:10 p.m. and 7:05 p.m. ET on Thursday, it said in a tweet. Issuers had frozen $2.80 billion of it, but $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens could still be moved, according to Arkham.

The attacker has kept moving funds. Early Friday, the wallets sent $38.82 million in Ethereum to a new address, while still holding $1.12 billion in ETH, Arkham said. Hours later, a Tron address tagged by Arkham as belonging to the attacker sent about $2.1 million in TRX to nine new addresses in 14 transfers, according to Arkham data.

The stablecoin freeze

Stablecoin issuers moved quickly as the funds left Binance. Tether and Circle froze about 975.1 million USDT and 823 million USDC held in the main receiving wallet, worth about $1.8 billion, Decrypt reported on Thursday, when an onchain tally put the drain at $5.57 billion. Binance co-founder Changpeng "CZ" Zhao thanked the two issuers for their "quick freeze."

As of Friday morning, Arkham's entity page for the attacker showed holdings of about 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL, alongside frozen stablecoin balances.