LEGACY & INSIGHTS: BUSINESS & TECHNOLOGY
Binance Says Hackers Took an Estimated $6.3 Billion and Customers Will Be Covered
Binance hack losses run to an estimated $6.3 billion, which would make it the largest crypto theft on record. The exchange says customer funds are safe and it will cover every loss, but its investigation has found more breaches than it first reported.
The Binance hack appears to be the largest crypto theft ever recorded. Binance, the biggest cryptocurrency exchange by trading volume, disclosed the attack on Thursday, halted withdrawals and put the damage at about $6.3 billion.
By Friday morning, the company said its investigation had found “additional points of breach” beyond the compromised engineer’s laptop it first suspected. It also said customer funds are safe, that it will cover every loss and that it expects withdrawals to resume within about two days.
Those are Binance’s statements, and the details matter. Outside firms, not Binance, have named a suspect. The amounts stolen, frozen and recoverable are also three different numbers.
What the Binance Hack Took, and What Has Been Frozen
Binance estimates the total impact at about $6.3 billion. Other estimates differ. Chainalysis put the amount stolen at roughly $5.9 billion at the time of the theft, and its chief executive, Jonathan Levin, later cited about $6.4 billion. TRM Labs counted about $6.36 billion leaving across ten blockchains, most of it in roughly 20 minutes.
The recovery picture is smaller. Binance says it has worked with other firms to freeze about $3 billion and has begun recovering some assets. Tether said it froze more than $1.57 billion in USDT, and Circle said it froze more than $800 million in USDC, CoinDesk reported. TRM estimated that about $2.4 billion had moved beyond the reach of any token issuer, according to The New York Times.
These numbers do not add up to a recovery. A freeze stops tokens from moving, but it is not the same as getting them back, and the reports we reviewed give no figure for assets actually returned.
How the Binance Hack Happened, as Binance Tells It
Binance’s first explanation was a compromised laptop. On Thursday, the company said a DevOps engineer’s device may have let the attacker reach a service container and submit unauthorized withdrawals. A day later, it said the investigation had uncovered more and described a complex attack.
Co-CEO Richard Teng said the attack was not a single action. Binance says it has found no evidence that wallet private keys leaked, but it has not yet explained the additional breach points. Blockaid, a security firm, preliminarily pointed to misuse of signing infrastructure rather than a leaked key, according to Cointelegraph.
Binance has promised a detailed technical postmortem when its investigation ends. Until then, the account of how the attack worked comes only from the company, in pieces.
Who Is Blamed for the Binance Hack, and on What Evidence
TRM Labs attributed the attack to TraderTraitor, a North Korean hacking unit it described as elite, with high confidence. It pointed to features that resemble earlier thefts. Chainalysis’s Levin said the attack was likely the work of the same group. The FBI attributed last year’s $1.5 billion theft from the exchange Bybit to TraderTraitor.
The independent investigator ZachXBT, according to Cointelegraph, found stolen funds mixed with proceeds of an earlier exploit of the exchange Bitget at one address. He said that suggests the same actor is likely behind both incidents.
Binance has not named anyone. Teng said its investigation has not attributed responsibility to any individual. None of the reports we reviewed cites a government attribution for this attack, so the blame so far rests on private analysis.
How Markets Reacted to the Binance Hack
Prices fell. Bitcoin dropped below $80,000 for the first time in more than a month, The New York Times reported. CoinDesk put the decline at 4.8 percent, to below $77,000, and said ether fell 5.7 percent, Binance’s BNB token 8 percent and Aave 11 percent.
Crypto-linked stocks also fell Friday. Coinbase dropped more than 11 percent, Robinhood nearly 8 percent and Strategy 10 percent in early trading, the Times reported. The selling suggests investors were reacting to the safety of custody at the largest platform, not to any change in the coins themselves.
The attack came in a month of other security incidents. Polymarket briefly paused trading Thursday after some users reported unauthorized withdrawals, Business Insider reported. There is no evidence the incidents are related.
FROM KMOB1003
What Is Still Unknown About the Binance Hack
Several answers are missing. Binance has not said what the additional breach points were or how the attackers reached them. It has not said how much of the money it can ultimately recover, and it has not named a suspect.
Coverage is also a promise, not yet a payment. Binance says it has set aside more than $6.34 billion of company funds to cover the incident, according to Business Insider. CoinDesk puts the exchange’s Secure Asset Fund for Users at roughly $1 billion. We have seen no independent verification of either figure.
Withdrawals also remain paused, so customers have not yet tested the company’s assurance that balances are safe.
What Happens Next in the Binance Hack Investigation
Binance says withdrawals should resume within about two days and that deposits already work. It says the frozen total could rise as it works with law enforcement, token issuers and blockchain-intelligence firms.
The technical postmortem, when it arrives, should answer the question the company has left open: how many ways into its systems the attackers found. The withdrawal date is the first promise Binance has made that customers can check for themselves.
Binance Hack Signal Breakdown
Not every claim about the Binance hack carries the same weight.
Reported by Binance
- Impact. Estimated at about $6.3 billion. Withdrawals are on hold and deposits still work.
- Cause. An early finding pointed to a compromised DevOps engineer’s laptop. A Friday update found additional points of breach.
- Coverage. Binance says it will cover all losses, has set aside more than $6.34 billion of company funds and has frozen about $3 billion with partners.
Attributed to Outside Firms
- TRM Labs. Attributes the attack to TraderTraitor, a North Korean group, with high confidence.
- Chainalysis. Says the attack was likely TraderTraitor and puts the amount stolen at roughly $5.9 billion at the time.
- ZachXBT. Found stolen funds mixed with proceeds of the earlier Bitget exploit at one address.
- Tether and Circle. Say they froze more than $1.57 billion in USDT and more than $800 million in USDC.
Not Established
- how the attackers got in beyond Binance’s early finding
- who is responsible, as a finding by Binance or a government
- how much of the stolen money can be recovered
- whether the reserve figures Binance and CoinDesk cite hold up
- whether the Polymarket incident is related (no evidence it is)
Sourcing: facts come from reporting by The New York Times, Business Insider, CBS News, CoinDesk and Cointelegraph, including their accounts of statements from Binance, TRM Labs, Chainalysis and others. We did not review Binance’s own posts, TRM’s analysis or on-chain data directly.
BINANCE HACK / KEY FACTS
RADAR / WHAT TO WATCH
KMOB1003 SELECTS
Music, style, tools, art and objects worth your attention.
