Binance exploit reaches $5.8B as stolen funds move across DEXs
Security & Exploits ·
Attackers tied to a reported $5.8 billion Binance security incident have funneled hundreds of millions through Uniswap and SUN io while Tether and the Arbitrum Security Council froze over $3 billion in assets.
Binance is investigating a security incident involving suspicious outflows reported at roughly $5 billion, according to The Block, with other reporting putting the total exploit figure at $5.8 billion. Of that, more than $3 billion in assets has reportedly been frozen by Tether and the Arbitrum Security Council, limiting how much of the stolen value the attackers can move or cash out.
In the past 24 hours, the hacker group has been actively swapping tokens across decentralized exchanges. On Uniswap, the group moved $819.92 million across more than 1,600 transactions, while on SUN io it moved $444.92 million across 32 transactions, according to OnchainLens. Wallet activity tied to the exploit can be tracked via an Arkham entity page, and the group continues to sell tokens.
Corroborating reports describe the incident as potentially originating from a compromised DevOps engineer's laptop, which granted attackers access to submit unauthorized withdrawal transactions; no private key leak has been confirmed. Separate analysis attributes the breach to exploitation of the EIP-7702 authorization mechanism, in which the attacker submitted 50 nonce-variant authorizations against a Binance hot wallet, with one succeeding in delegating the wallet's code to a malicious contract.
Binance has confirmed the security incident and suspended deposits and withdrawals pending investigation. Co-founder He Yi has pledged that Binance will cover all hacking losses, a commitment also noted by Wu Blockchain, with the exchange reassuring users that their funds are safe.
What remains unresolved is the precise initial entry point into Binance's systems, the final total of funds successfully laundered versus frozen, and the timeline for restoring deposits and withdrawals. Ten distinct sources are currently tracking the cluster, and the hacker group's continued selling suggests the situation is still active rather than contained.