Binance reported on Friday that a compromised laptop was not the sole vector in the massive security breach that hit approximately $6.3bn of its assets on Thursday, according to The Next Web. The world's largest crypto exchange stated that its ongoing investigation uncovered additional points of breach during the incident.
Key takeaways
- Binance confirmed that additional points of breach were found alongside a compromised DevOps engineer's laptop.
- Blockchain analytics firm TRM Labs estimates the total theft at $6.36bn, marking it as the largest crypto theft on record.
- Stablecoin issuers and protocols froze between $2.7bn and $3bn of the stolen funds within hours.
- Binance announced it will cover all losses using its Secure Asset Fund for Users and company funds.
What caused the massive binance hack?
Binance initially suggested that a security incident involving a compromised DevOps engineer's laptop allowed an attacker to enter a service container and submit unauthorised withdrawals. However, subsequent updates noted that the event stems from multiple factors. Co-CEO Richard Teng wrote on X that the attacker did not simply use one engineer's permissions and that the event was not a single one-click action.
According to TRM Labs, the preparation started at least 36 hours earlier when the attacker funded a wallet using Tornado Cash and rehearsed on test wallets. On Ethereum, the attacker used the EIP-7702 feature to hand control of a hot wallet to their own code, moving 167,464 ETH and other tokens in a single transaction. Wallets on other chains including Bitcoin, Tron, Solana, and the XRP Ledger moved funds through ordinary signed transfers.
Crypto theft and recovery efforts
TRM Labs attributes the massive crypto theft to TraderTraitor, a North Korean state hacking unit, with Chainalysis also tying the attack to the same group. Stablecoin issuers moved quickly to lock down funds. Tether froze 971.1 million USDT and Circle froze 823 million USDC. Additional freezes came from Ripple, World Liberty Financial, and the Arbitrum network's Security Council, while Aave froze affected lending markets.
Despite these freezes, the attacker still holds over 420,000 ETH and 18,270 BTC, valued at about $2.4bn, which issuers cannot freeze. Before the freezes took full effect, the attacker sold about 325 million USDT for ETH at a discount exceeding 10 percent. Binance paused withdrawals to halt the outflows and stated that deposits are operating normally by Friday.
What happens next for users and markets?
Bitcoin dropped below $77,000 for the first time in over a month following the news. Binance plans to publish a root-cause report, a technical post-mortem, and an updated proof of reserves once its investigation concludes. The exchange expects to resume withdrawals within 45 hours of its latest update following a security revamp, while Binance.US confirmed it was not affected by the incident.
Frequently asked questions
Blockchain analytics firm TRM Labs estimates the theft at $6.36bn, while Binance reports the affected assets at about $6.3bn.
TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean state hacking unit, though Binance has not named a culprit.
Binance stated that it will cover all losses using its Secure Asset Fund for Users emergency reserve and company funds.
Stablecoin issuers and protocols froze between $2.7bn and $3bn of the stolen funds within hours of the attack.
Binance stated that the incident stems from multiple factors, involving additional points of breach alongside a compromised DevOps engineer's laptop.
Based on reporting by The Next Web. Read the original article
