Binance puts security incident impact at $6.3 billion

Binance says a security incident had an estimated impact of about $6.3 billion, prompting the exchange to pause withdrawals while it investigates and works to freeze assets. In its security incident update on Friday, October 30, Binance said about $3 billion had been frozen on-chain, meaning on public blockchains.

The company said it would cover all losses using its Secure Asset Fund for Users (SAFU), a fund set aside to protect customers, and company funds. Binance also said it had found no evidence that wallet private keys were leaked. The investigation is ongoing, and the company said it will publish a technical report when its findings are verified.

What does Binance say caused the incident?

Binance’s initial investigation suggests an attacker may have used a compromised laptop belonging to a DevOps engineer, a worker who helps maintain software and systems. The attacker then gained access to a service container and submitted unauthorized withdrawal transactions, Binance said.

The Associated Press reported that blockchain intelligence firm TRM said an attacker moved about $6.36 billion from Binance wallets across 10 blockchains, mostly within about 20 minutes. AP also reported that Binance later found additional “points of breach.” The exchange has not yet published its full account of how the incident happened.

What can Binance customers do while withdrawals are paused?

Binance said deposits were unaffected, but withdrawals remained suspended as it carried out security checks. The company told AP it expected withdrawals to resume within a day or two. Binance also said it revoked the affected address authorisation and is working with law enforcement and blockchain partners to trace and recover assets.

Users can check Binance’s service announcements for updates. The exchange said its teams are working to resolve the issue and that customer funds are safe. AP reported that the company had pledged to cover all losses.

Who does the investigation point to?

TRM attributed the attack to TraderTraitor, which it described as a North Korean hacking unit, and said it had high confidence in that assessment. Blockchain analysis firm Chainalysis also said the attack was likely carried out by the group, AP reported.

Binance has not confirmed who was responsible. It told AP it was working with law enforcement to identify the attackers. The exchange has said more technical details will follow once its investigation is complete.

References

• security incident update — binance.com