Binance, the world’s largest cryptocurrency exchange by trading volume, has reported that Thursday’s security breach affected approximately $6.3 billion in digital assets, with about $3 billion of these funds now frozen onchain following swift actions by blockchain partners and stablecoin issuers.
Complex Attack Uncovered, No User Losses Expected
The exchange revealed that its investigation initially centered on a compromised DevOps engineer’s laptop, which might have enabled an attacker to access a service container and submit unauthorized withdrawal transactions. However, Binance has now identified additional points of breach, indicating a more sophisticated attack process.
Chief Executive Officer Richard Teng emphasized that the incident involved multiple attack vectors, stating that responsibility has not been attributed to any individual. He assured that the breach was not a simple one-click event, but rather the result of a coordinated and complex operation.
“This was a complex attack. The attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. Our investigation has not attributed responsibility to any individual,” Teng stated.
Binance announced that it will cover all losses from the incident by using its Secure Asset Fund for Users (SAFU) alongside company funds, reaffirming that “user funds are safe.” Withdrawals remain suspended as the exchange revamps its withdrawal services and related addresses, although deposits have been reopened as of Friday morning.
SAFU is Binance’s emergency insurance fund, established to protect user assets in extreme situations. The exchange also confirmed it is working closely with law enforcement agencies and blockchain analytics firms to trace and recover the stolen crypto assets.
Mini dictionary: SAFU (Secure Asset Fund for Users) – Binance’s insurance fund designed to cover unexpected losses and protect user assets during major incidents.
Stablecoin Issuers Freeze $1.8 Billion, Ongoing Asset Tracing
Blockchain analytics platform Arkham estimated the total outflow at $6.01 billion, largely drained from Binance hot wallets on nine blockchains in under three hours Thursday. During the attack, stablecoin issuers Tether and Circle froze approximately 975.1 million USDT and 823 million USDC, totaling around $1.8 billion locked in the main receiving wallet suspected to belong to the attacker.
Binance co-founder Changpeng Zhao thanked both Tether and Circle for their quick action in immobilizing the stolen digital assets. Meanwhile, Arkham reported ongoing activity from wallets linked to the attacker, tracking substantial movements including $38.82 million in Ethereum and $2.1 million in TRX distributed to multiple new addresses.
| Asset | Total Outflow | Amount Frozen | Estimated Remaining |
|---|---|---|---|
| All Assets (Total) | $6.3 billion | $3 billion | $3.3 billion |
| Stablecoins (USDT & USDC) | $1.8 billion | $1.8 billion | $0 |
| BTC, ETH, TRX, SOL | Not specified | Partially frozen | Wallets hold significant remaining balances |
According to Arkham’s data Friday, the attacker retained about 18,270 BTC, 488,364 ETH, 663.6 million TRX, and 970,551 SOL. Despite asset freezes, significant funds in these tokens remain accessible for movement.
Binance Remains Vigilant, Full Update Promised
While Binance has not officially declared the event a hack, it acknowledged an ongoing investigation into a potential security issue. Its team is conducting a technical post-mortem to determine the precise circumstances and will publish an updated proof of reserves after completing remediation measures.
Binance has pledged to provide a detailed technical report once the investigation concludes and all facts are verified, ensuring transparency for its users.
With deposits operating as normal, Binance is coordinating with law enforcement worldwide and blockchain intelligence providers in ongoing efforts to recover user funds and prevent further losses. The company maintains that user assets remain secure, as all losses from the incident will be fully covered by Binance.
