Binance, the largest cryptocurrency exchange globally by trading activity, has paused all deposits and withdrawals after a suspected cyber breach involving an estimated $6.3 billion in assets. The platform said Friday that it had opened an investigation and was coordinating with blockchain partners to block and recover the affected funds.
Initial findings indicate the intrusion may have begun with the compromised laptop of a DevOps engineer. Binance said the device may have given an attacker access to a service container that was used to submit unauthorised withdrawal requests.
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions,” the company said.
Quick facts
- The suspected attack involves assets valued at about $6.3 billion.
- Roughly $3 billion of the affected assets has already been frozen through blockchain-sector cooperation.
- Binance said no wallet private keys appear to have been exposed.
- The exchange has suspended deposits and withdrawals while security reviews continue.
- Customer losses will be covered through the Secure Asset Fund for Users, or SAFU, and company funds.
The exchange said it had not found evidence that private keys linked to wallets had been compromised. A full technical report will be issued once the inquiry and remediation work have been completed.
Binance put the estimated financial exposure at approximately $6.3 billion. It said partners had helped freeze around $3 billion of the assets directly on the blockchain, limiting the amount still subject to tracing and recovery efforts.
The company said customers would not absorb losses arising from the incident. It pledged to use its SAFU reserve fund and corporate balance sheet resources to make users whole.
“User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete,” Binance said.
Deposits and withdrawals were halted as an immediate protective measure while the exchange conducts security checks. Binance also removed authorisation for the address involved in the incident.
The company said it had alerted law-enforcement authorities and blockchain intelligence groups to help track the assets and support recovery efforts. Its security and engineering teams are working continuously on the response, while investigators seek to identify and prosecute those responsible.
Further information will be released as the investigation develops, Binance said.
