Binance, the world’s largest crypto exchange by volume, reported a security breach of around $6.3 billion on Thursday. It prompted a coordinated effort to freeze stolen assets.
On October 29, within minutes, Binance wallets on Ethereum, XRP Ledger, Bitcoin, Solana, Tron, and four other networks had sent their balances to addresses controlled by a single attacker. A second wave hit Binance wallets on Avalanche and Polygon ataround 23:05 UTC.
The crypto exchange announced that roughly $3 billion had been frozen on-chain.
The estimated tota limpact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with $3 billion frozen on-chain so far, said Binance.
Important Read: Crypto Hacks Explained: How They Happen and How to Protect Yourself
Tether and Circle freeze stablecoins
The CEOs of stablecoin issuers Tether and Circle both came forward in support of Binance and said they were tracking the hack.
Tether froze nearly $1.57 billion in USDT.
Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone, said Tether CEO Paolo Ardoino.
Circle’s Jeremy Allaire said his firm has blocked more than $800 million in USDC, Reuter sreported.
Ripple also froze approximately $200 million, according to Binance co-founder Yi He.
The issuer’s actions block transfers from affected addresses, limiting the attacker’s ability to move or cash out those stablecoins.
The attacker also used stolen USDT as collateral on lending platform Aave to borrow at least 20,000 wrapped ether, worth around $44 million.
According to DefiLlama data, Binance held roughly $144 billion in assets on its platform before the hack. The stolen funds would amount to approximately 4% of its total holdings.
Currently, the crypto exchange’s total assets stand at $135.178 billion.
Binance investigates compromised laptop
The initial investigation by Binance pointed to a compromised DevOps engineer’s laptop that may have allowed the attacker to access an internal system and submit unauthorized withdrawals.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions, said Binance.
The crypto exchange found no evidence of a wallet private-key leak.
We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified, said Binance.
It revoked the affected address authorization and engaged law enforcement and blockchain intelligence firms to trace and recover assets.
Blockchain intelligence firm TRM Labs attributed the attack to North Korea’s TraderTraitor group with high confidence, citing blockchain activity and other intelligence. It traced approximately $6.36 billion leaving Binance wallets across ten blockchains, with most transfers occurring within about 20 minutes. Its estimate valued each transfer at the asset’s price when it was taken.
Withdrawals remain suspended
Withdrawals on Binance remain suspended as of now.
Deposits remain unaffected and continue to operate as normal. Our team is currently working on enhancements to the withdrawal service and related address controls. We expect to begin resume withdrawal services in the next 48 hours, said Yi He.
Binance has pledged to cover losses using its Secure Asset Fund for Users, known as SAFU, alongside company funds. It also promised an updated proof-of-reserves report after remediation.
Sign up on WEEX and roll for a chance to win a share of the $1,000,000 prize pool.
