Binance Reports Additional Breach Points in $6.3 Billion Security Incident

Highlights

Binance estimates Thursday’s security incident affected assets worth around $6.3 billion. The exchange initially described a potentially compromised DevOps engineer’s laptop, but its investigation later identified “additional points of breach” and a more complex attack process. Binance says it will cover losses using its SAFU reserve and company funds, and that user funds are safe. About $3 billion of affected assets has been frozen onchain, while withdrawals remain suspended during a security revamp; deposits have resumed. Blockchain analytics firm Arkham reported a $6.01 billion haul and said some assets remained movable. The investigation has not yet established the full attack path or attributed responsibility to an individual.

Sentiment Analysis

• The article’s tone is primarily cautious and factual. It reports Binance’s estimate of around $6.3 billion in affected assets, the suspension of withdrawals, and the continuing investigation without treating preliminary explanations as conclusive.
• There is a reassuring element in Binance’s statements that user funds are safe and that losses will be covered through its SAFU fund and company funds. The freezing of about $3 billion onchain, with assistance from blockchain partners and stablecoin issuers, is also presented as a containment measure.
• However, the report remains notably concerning: Binance identified additional breach points, the attack was described as complex, and Arkham reported that some assets could still be moved. The continued movement of funds underscores that recovery efforts are ongoing.
• Overall, sentiment is mixed, leaning negative because of the scale of the incident and unresolved security questions, while the planned reimbursement and partial asset freezes offer limited reassurance.

Article Text

Binance said Friday that its investigation into Thursday’s security incident had uncovered “additional points of breach.” The exchange estimates the total impact at around $6.3 billion. Its initial account focused on a potentially compromised DevOps engineer’s laptop, but the company now describes the event as a complex attack and says it is still gathering facts.

In an update issued late Thursday, Binance said the compromised laptop may have enabled an attacker to access a service container and submit unauthorized withdrawal transactions. The company also said it had found no evidence that wallet private keys were leaked. Binance later clarified that its first explanation was based on an initial investigation and that subsequent work had revealed other possible points of compromise.

Binance CEO Richard Teng said the attacker did not simply rely on one engineer’s permissions or carry out a single “one-click” action. He described a more complex process and said the investigation had not attributed responsibility to any individual. The exchange has not provided a complete technical account, saying it will publish a detailed post-mortem after the investigation is finished and the facts have been verified.

Binance paused withdrawals and initially suspended deposits as it responded to the incident. Teng said deposits were operating as normal by Friday morning, but withdrawals remained suspended while the company carried out a security revamp of the withdrawal service and related addresses. Binance said it remained on track to resume withdrawals in 45 hours. The exchange also revoked authorization for the affected address and said it was working with law enforcement and blockchain intelligence firms to trace and recover assets.

The company said about $3 billion of affected assets had been frozen onchain with assistance from blockchain partners. It also stated that it would cover all losses from its SAFU fund, an emergency reserve for users, and company funds. Binance said user funds were safe. The report does not establish the final amount recoverable or provide a completed assessment of the incident’s effects.

Blockchain analytics firm Arkham estimated that $6.01 billion had been taken from Binance hot wallets across nine blockchains between 4:10 p.m. and 7:05 p.m. ET on Thursday. Arkham said issuers had frozen $2.80 billion, while $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens could still be moved. These figures are Arkham’s estimates and differ from Binance’s overall impact estimate.

Arkham also reported continued movement of assets after the incident. Early Friday, wallets sent $38.82 million in Ethereum to a new address, while still holding $1.12 billion in ETH. Hours later, a Tron address identified by Arkham as belonging to the attacker sent about $2.1 million in TRX to nine new addresses through 14 transfers. These reported transactions indicate that asset tracking and recovery remained active.

Stablecoin issuers also acted as funds moved from Binance. Tether and Circle froze about 975.1 million USDT and 823 million USDC in the main receiving wallet, together worth about $1.8 billion, according to Decrypt’s Thursday report. At that point, an onchain tally put the outflow at $5.57 billion. Binance co-founder Changpeng “CZ” Zhao thanked both issuers for the freeze.

As of Friday morning, Arkham’s entity page for the attacker showed holdings of about 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL, alongside frozen stablecoin balances. Binance said it would publish an updated Proof of Reserves after remediation was complete. The reported figures remain estimates from different sources, and Binance’s investigation and recovery work are ongoing.

Key Insights Table