Binance Finds Wider Breach in $6.3 Billion Hack, Targets Sunday Withdrawal Restart
Binance said it has identified additional points of breach beyond an initially suspected compromised engineer's laptop in a security incident it estimates cost about $6.3 billion. The exchange is targeting a withdrawal restart on Sunday and plans to publish updated proof of reserves on Monday, though outside estimates of the drained amount differ.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Binance Has Disclosed
Binance said on Friday that its investigation has uncovered "additional points of breach" beyond the compromised DevOps engineer's laptop it had first identified, and it estimates the incident cost around $6.3 billion. In its earlier announcement the exchange said the attacker used that laptop to reach a service container and submit unauthorized withdrawal transactions, and it stated it had found no evidence of a wallet private key leak.
CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action," describing a more complex process. He also said the attacker erased evidence and bypassed security checks, and that Binance has not attributed responsibility to any individual.
Estimates of the Outflow Differ
The size of the outflow varies by source. Blockchain analytics firm Arkham put the haul at $6.01 billion, taken from Binance hot wallets across nine blockchains between 4:10 p.m. and 7:05 p.m. ET on Thursday. An earlier onchain tally cited by Decrypt put the drain at $5.57 billion. Binance's own figure of about $6.3 billion is higher than both, and the exchange has not published a breakdown that reconciles the gap.
Arkham said about $2.80 billion had been frozen by issuers, while $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens could still be moved. Binance said roughly $3 billion of affected assets had been frozen onchain with help from blockchain partners.
Freezes, Losses and Ongoing Fund Movements
Tether and Circle froze about 975.1 million USDT and 823 million USDC held in the main receiving wallet, worth about $1.8 billion, according to Decrypt's Thursday reporting. Binance co-founder Changpeng Zhao thanked the two issuers for their "quick freeze." Binance said it will cover all losses from its SAFU emergency reserve and from company funds, and that user funds are safe.
The attacker has continued to move assets. Early Friday the wallets sent $38.82 million in Ethereum to a new address while still holding $1.12 billion in ETH, according to Arkham. A Tron address Arkham tagged as the attacker's sent about $2.1 million in TRX to nine new addresses over 14 transfers. As of Friday morning, Arkham's entity page showed holdings of about 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL, alongside frozen stablecoin balances.
Recovery Timeline
Binance suspended deposits and withdrawals, revoked the affected address authorization, and is working with law enforcement and blockchain intelligence firms. Deposits were operating normally by Friday morning, according to Teng. Withdrawals remain suspended while the exchange completes a security revamp of the withdrawal service and related addresses. CoinDesk reports the exchange is targeting a withdrawal restart on Sunday.
Binance said it will publish a detailed technical post-mortem once every fact is verified, and plans to release an updated proof of reserves Monday, according to CoinDesk. Teng said the exchange's investigation is still gathering facts.
Why It Matters
For Traders
Withdrawals remain suspended until the targeted Sunday restart, so exposure to Binance-linked liquidity and withdrawal timing depends on whether that schedule holds.
For Investors
A loss estimate of $6.3 billion, with Binance covering losses from its SAFU fund and company funds, puts the exchange's reserve adequacy and proof of reserves under close scrutiny.
For Builders
The attack reportedly bypassed security checks across multiple points, so withdrawal authorization and hot-wallet key management designs warrant review.
This article is for information only and is not financial advice. Read the full disclaimer.
