Binance’s initial look, set out in an updated security notice, suggests the laptop of a DevOps engineer may have been compromised and used to reach a service container, where an attacker may have filed withdrawal transactions staff had not approved. Binance puts the estimated damage from the incident in its hot wallets at around $6.3 billion. It says it has seen no sign that a private key got out. The earlier report followed the first public freeze tally. The amount stopped on chain is higher in this notice, at about $3 billion. That figure counts coins partners have frozen. The $6.3 billion is the exchange’s estimate of the full impact.
The BBC reported a statement from Richard Teng, a co-chief executive, that the route may have run from a laptop into a container. He said the intrusion “was not a simple ‘one-click’ action” and that the process was more involved. Later coverage quoting Teng said the inquiry had also found additional points of breach and had not pinned the incident on any one person. That report says withdrawals are still suspended, that Binance still expects to turn withdrawals back on in about 45 hours, and that it is not yet known who carried out the attack, though some analytics companies have pointed toward North Korea and that link is unconfirmed.
The notice says Binance will pay every loss from SAFU, its emergency reserve for incidents, and from the company’s own cash, and that money held for customers is safe. After the cleanup, it says, the exchange will publish a new proof of reserves. Withdrawals stay off while the checks continue. A revision of the notice made clear that deposits were left running and still are. It also says the permission on the address tied to the incident has been cancelled, and that law enforcement and companies that trace coins are working to follow what moved and try to get funds back. A longer technical write-up will wait until the inquiry is finished and the facts have been checked.
Chainalysis has published an assessment of its own. Binance has not confirmed it. Chainalysis counts the unauthorized transfers at roughly $6.4 billion, a little above the exchange’s estimate, and counts near $2.8 billion as frozen. Its investigators assess that TraderTraitor, which they describe as a North Korean cybercrime group, carried out the theft. They say the judgment comes from on-chain activity in the hours after the outflows. The strongest tie they describe is coins from this incident that mingled with coins taken in the Bitget exploit a month earlier, an overlap the team says it watched while it was happening. That Bitget case had already been attributed to North Korean actors.
Chainalysis also says the stolen coins are still moving, and it expects more transfers in the days ahead. The pattern looks new to its investigators. They describe thousands of transactions packed into a short stretch, and they read that pace as automation. One step they keep seeing is an address that receives exactly 1 TRX, then a larger amount, then sends the coins on. Some of the money circles back to addresses that had already appeared. It says freezes began while the attacker was still shifting coins an issuer can block, such as a stablecoin, into coins that cannot be blocked.
On Ethereum, according to CoinDesk, the attacker used EIP-7702, a feature that can let a normal wallet execute contract code, and removed about $2.5 billion from one Binance wallet in under four minutes. CoinDesk treats that sum as one piece of a loss that ran across several chains.
This article is not investment advice.
