Binance uncovers more breach points in $6.3 billion security incident
Security & Exploits ·
The exchange says its probe now points to several entry points beyond the single compromised laptop first blamed for the attack, while roughly $3 billion in stolen assets has been frozen.
Binance has revised its account of Thursday's security incident, now estimated at around $6.3 billion in total impact, saying its ongoing review has turned up "additional points of breach" beyond the initial explanation of a compromised DevOps engineer's laptop, according to Decrypt. The exchange had first described how access to that laptop may have let an intruder reach a service container and push through unauthorized withdrawal requests, while stressing no wallet private keys were exposed, a detail also outlined by WuBlockchain.
CEO Richard Teng characterized the episode as far from a single-step intrusion, stating the attacker did not rely on one engineer's access alone and that no individual has been identified as responsible so far, a message he posted directly on X. Binance has echoed that framing publicly, calling it a complex, coordinated attack rather than an isolated lapse.
About $3 billion of the affected funds has been frozen onchain with assistance from blockchain partners, and Binance has pledged to absorb all losses using its SAFU reserve along with company capital, a commitment detailed by CryptoPotato. The firm has reported setting aside $6.34 billion in company funds to cover the shortfall, with $5 billion of that already held in the affected tokens and the rest being sourced through market purchases and OTC deals. Deposits have resumed normal operation, though withdrawals stay paused while Binance rebuilds security around its withdrawal system and associated addresses.
Separate tracking from Arkham put the total haul closer to $6.01 billion, pulled from Binance hot wallets across nine blockchains within a roughly three-hour window Thursday afternoon. Of that, issuers had frozen about $2.80 billion, leaving an estimated $2.9 billion across Ethereum, Bitcoin, Tron, Solana and other assets still in motion. Early Friday, the attacker reportedly shifted $38.82 million in ETH to a fresh address while continuing to hold over $1 billion in ether. The incident also coincided with bitcoin falling below $77,000, a move tied to the hack by The Block.
Binance says it is working with law enforcement, including the FBI and U.S. Secret Service, alongside blockchain intelligence firms to trace the remaining funds. A full technical post-mortem and an updated Proof of Reserves are expected once remediation finishes, but no timeline has been given, and it remains unclear how many additional breach points investigators have found or whether withdrawals will resume on the originally stated 45-hour schedule.