Binance has revised its assessment of Thursday’s security incident, estimating the total impact at approximately $6.3 billion after initially attributing the breach to a compromised DevOps engineer's laptop. The exchange announced on Friday that its investigation uncovered "additional points of breach," describing the event as a complex attack rather than a single unauthorized action. CEO Richard Teng clarified that responsibility has not been attributed to any individual and emphasized that no evidence of wallet private key leaks was found.
Approximately $3 billion of the affected assets have been frozen onchain through coordination with blockchain partners and issuers. Tether and Circle froze about 975.1 million USDT and 823 million USDC, respectively, in the main receiving wallet. Despite these freezes, analytics firm Arkham reported that roughly $2.9 billion across Ethereum, Bitcoin, Tron, Solana, and other tokens remained movable. Early Friday, the attacker transferred $38.82 million in Ethereum to a new address and moved about $2.1 million in TRX to nine new addresses.
Binance stated it will cover all user losses using its SAFU emergency reserve fund and company funds, asserting that user funds remain safe. Deposits resumed by Friday morning, while withdrawals remain suspended pending a security revamp of the withdrawal service. The exchange plans to publish a detailed technical post-mortem and an updated Proof of Reserves once the investigation is complete.
The shift from blaming a single compromised device to identifying multiple breach vectors suggests a sophisticated, multi-stage intrusion that challenges standard perimeter defenses. This complexity implies that the attackers likely exploited systemic vulnerabilities or misconfigurations beyond simple credential theft, raising questions about the depth of Binance's internal security audits prior to the incident. The rapid freezing of stablecoins highlights the critical role centralized issuers play in mitigating crypto theft, yet the remaining unmovable funds indicate that traditional blockchain immutability still limits full recovery efforts.
Market confidence hinges on Binance's ability to transparently execute its promised post-mortem and maintain solvency without external bailouts. While the SAFU fund provides a buffer, covering a $6.3 billion loss places significant pressure on the exchange's liquidity management and operational resilience. Investors and users should monitor whether the suspension of withdrawals leads to broader regulatory scrutiny regarding custody practices and incident response protocols across major exchanges.
