Binance Finds Further Breach Points in Estimated $6.3bn Hack, Moving Beyond Laptop Theory

Binance has identified further points of compromise in the security incident that drained an estimated $6.3bn from the exchange on Thursday. The finding widens its account of the attack beyond the single compromised engineer's laptop it pointed to at first.

The world's largest crypto exchange said on Friday that the attack was more complex than its preliminary findings suggested. Withdrawals remain suspended while it rebuilds the affected systems.

From one laptop to a wider breach

In a statement late on Thursday, Binance said the incident appeared to have started with a compromised laptop belonging to a DevOps engineer. DevOps staff typically manage the infrastructure that keeps an exchange's software running.

According to that first account, the compromise may have let the attacker reach a service container, an isolated environment in which a piece of software runs. From there, the attacker could submit withdrawal transactions that had not been authorised. Binance said it had found no evidence that any wallet private keys had leaked.

By Friday the picture had changed. The exchange said follow-up work had uncovered additional points of breach, and it described the incident as a complex attack whose facts were still being gathered.

Chief executive Richard Teng said the attacker "did not simply use one engineer's permissions". He added that the intrusion was not a single one-click action and that the investigation had not blamed any individual.

The change in emphasis matters. A single stolen laptop points to a contained failure. Multiple entry points suggest the attacker either moved through several systems or exploited more than one weakness, which raises harder questions about the exchange's internal controls.

The scale of the drain

Binance's own estimate puts the loss at about $6.3bn. Blockchain analytics firm Arkham gave a slightly lower figure of $6.01bn, taken from Binance hot wallets across nine blockchains.

Arkham said the outflows ran between 4:10pm and 7:05pm Eastern Time on Thursday, a window of almost three hours. Hot wallets are connected to the internet so an exchange can process customer withdrawals quickly, which makes them more exposed than offline cold storage.

Estimates rose as the day went on. On Thursday, Decrypt reported that an onchain tally put the drain at $5.57bn, before the later figures from Arkham and Binance.

As of Friday morning, Arkham's page for the attacker showed holdings of roughly:

• 18,270 BTC
• 488,364 ETH
• 663.6m TRX
• 970,551 SOL

The page also listed stablecoin balances that had been frozen.

Freezes recover about half

The most immediate relief came from stablecoin issuers. Tether and Circle froze about 975.1m USDT and 823m USDC held in the attacker's main receiving wallet, together worth around $1.8bn, according to Decrypt.

Binance co-founder Changpeng Zhao publicly thanked both companies for acting quickly. Centrally issued stablecoins can be blocked at the contract level by their issuers, a power that is often criticised by those who value censorship resistance but that proved useful in this case.

Binance said about $3bn of the affected assets had been frozen onchain with help from blockchain partners. Arkham put the amount frozen by issuers at $2.80bn.

That still leaves a large sum out of reach. Arkham estimated that about $2.9bn in Ethereum, Bitcoin, Tron, Solana and other tokens remained movable. Unlike dollar-pegged stablecoins, native assets such as bitcoin and ether have no central issuer able to freeze them.

The attacker has continued to shift funds. Early on Friday, the wallets sent $38.82m in ether to a new address while keeping about $1.12bn in ETH, Arkham said. Hours later, a Tron address that Arkham attributes to the attacker sent around $2.1m in TRX to nine fresh addresses across 14 transfers.

Splitting funds across many addresses is a common way to complicate tracing before assets are passed through mixers, bridges or exchanges. Each new transfer gives investigators more data, but also more trails to follow.

Binance pledges to cover losses

Binance has told customers their money is safe and that it will make good every loss. It said compensation will come from its Secure Asset Fund for Users, known as SAFU, which is an emergency reserve for users, and from company funds.

The exchange's first response was to halt deposits and withdrawals and revoke authorisation for the affected address. It said police agencies and onchain analytics specialists were assisting its efforts to follow the stolen funds and get them back.

Binance said the outflows ended once withdrawals were paused. By Friday morning, Teng said deposits were running normally. Withdrawals stayed suspended while the exchange carried out a security overhaul of the withdrawal service and its linked addresses, and Binance said it remained on track to restore them within 45 hours.

Teng said a detailed technical post-mortem would be published once the investigation is finished and every fact checked. He also said Binance would release an updated Proof of Reserves once remediation is complete.

Proof of Reserves reports are meant to show that an exchange holds enough assets to cover customer balances. After a loss of this size, the next report is likely to be read closely as evidence of whether Binance can absorb the hit without touching customer holdings.

Risks and open questions

The pledge to cover losses is meant to reassure users, but it depends on the exchange's reserves and how much of the frozen money can actually be returned. Frozen stablecoins are not the same as recovered stablecoins, and the timing and process for any release are not yet clear.

The nearly $3bn in movable tokens remains the main uncertainty. The longer those assets stay in the attacker's control, the more chances there are to launder them.

The revised account also creates reputational risk. Binance moved within a day from a relatively narrow explanation to a description of a multi-point, complex breach. Until the post-mortem is published, outsiders cannot judge how the attacker got in, how long access lasted or whether similar weaknesses exist elsewhere.

The statement that no private keys leaked is significant, since it suggests the attacker abused the systems that approve withdrawals rather than stealing direct control of the wallets. That distinction will shape how far the exchange needs to go in rebuilding its infrastructure.

What to watch next

The first test is whether withdrawals resume within the 45-hour window Binance has set. A delay would probably add to pressure on the exchange.

Investigators and analysts will also follow the attacker's wallets, especially the large ether balance and the Tron addresses that have started to fan out. Any further freezes by issuers or partners would reduce the amount at risk.

Finally, the technical post-mortem and the updated Proof of Reserves will be the main sources for understanding what failed and whether Binance's balance sheet remains sound. Both are promised only after the investigation and remediation are finished, so the full picture may take some time to emerge.