Binance stated that the total impact of the security incident on Thursday was estimated to be around $6.3 billion, and mentioned that approximately $3 billion of this amount has been frozen on the blockchain. The company initially attributed the issue to a laptop of an engineer with the username DevOps that was compromised, but now indicates that the investigation has uncovered "additional vulnerabilities."
On Friday, Binance stated that the total loss from this incident was approximately $6.3 billion. Earlier on Thursday, the exchange issued a notice stating that a laptop belonging to an engineer with the username DevOps may have been compromised, allowing the attackers to access a service container and submit unauthorized withdrawal transactions. At that time, Binance said, "We have not found any evidence of private key leakage from any wallets."
An update posted by Binance on X stated: "Our initial investigations indicated that this security incident may have involved a compromised laptop, but subsequent investigations revealed additional breakthroughs. This was a complex attack, and we are coordinating with all parties to make every effort..."
Anchorage CEO Richard Teng stated on Friday that the attackers “did not just use the privileges of one engineer, and it was not a single ‘one-click’ operation,” but rather “a more complex attack process.” He wrote, “Our investigation has not yet attributed responsibility to any individual.”
Binance stated that with the help of its blockchain partners, approximately $3 billion in affected assets have been frozen on the blockchain. The exchange mentioned that it will utilize its user emergency reserve fund SAFU as well as company funds to cover all losses, and assured that "user funds are safe."
Binance initially suspended deposits and withdrawals, revoked the authorization of affected addresses, and is cooperating with law enforcement agencies and blockchain intelligence companies to track down and recover the funds. On Friday morning, Teng stated that deposits have "returned to normal operation," while withdrawals are still suspended. The exchange is in the process of completing "safety improvements to the withdrawal service and related addresses."
Blockchain analysis firm Arkham stated in a tweet that the total amount of funds was $6.01 billion, which was transferred from Binance's hot wallets onto nine different blockchains between 4:10 PM and 7:05 PM on Thursday Eastern Time. Arkham indicated that the issuer has frozen $2.8 billion of this amount, but there is still $2.9 billion in Ethereum, Bitcoin, Tron, Solana, and other tokens that may continue to be transferred.
The attackers continue to transfer funds. According to Arkham, earlier on Friday, these wallets transferred $38.82 million in Ethereum to a new address, while still holding $1.12 billion in ETH. A few hours later, a Polkadot address identified as belonging to the attackers sent approximately $2.1 million in TRX to 9 new addresses across 14 transactions, as shown by Arkham data.
Stablecoin freeze
As funds flowed out of Binance, stablecoin issuers quickly took action. On Thursday, Decrypt reported that Tether and Circle froze approximately 975.1 million USDT and 823 million USDC, totaling around $1.8 billion, in their main receiving wallets; at that time, on-chain statistics showed that the scale of capital outflow was $5.57 billion. Zhao Changpeng (CZ), co-founder of Binance, thanked these two issuers for their "quick freezing" measures.
As of Friday morning, the attacker's profile page for Arkham showed that they held approximately 18,270 BTC, 488,364 ETH, 663.6 million TRX, and 970,551 SOL, in addition to a balance of stablecoins that had been frozen.
