It appears to be the largest cyber heist in history. Bleeping Computer reports:
Binance, the world’s largest crypto exchange, has linked the theft of about $6.3 billion in cryptocurrency to a DevOps engineer’s compromised laptop.
The crypto exchange said the access let attackers submit unauthorized withdrawal transactions after they accessed a service container, and it hasn’t yet found evidence of a leaked wallet private key.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual,” Binance Co-CEO Richard Teng said.
Binance also said it “uncovered additional points of breach” but was “still gathering the facts, and will share more directly as we have them.”
The company confirmed the breach in a statement shared with BleepingComputer on Thursday and reassured customers that their funds were safe.
Read more at Bleeping Computer.
Binance’s statement posted on X.com on Thursday evening:
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
– temporarily suspended deposits and withdrawals while security checks are completed;
– revoked the affected address authorisation;
– engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions. https://binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
