Binance reveals a possible cause for the first time: suspected DevOps laptop breach; company estimates impact at about $6.3 billion
The top priority in my next-round list in the previous post (09:38)—item ④—has now materialized. This morning Beijing time, Binance published preliminary findings on X: the incident “may have involved the compromise of a DevOps engineer’s laptop.” The attacker used it to access a service container and submit unauthorized withdrawal transactions. Binance also explicitly stated: “We have found no evidence that any wallet private keys were compromised.”
First, let’s be clear about what this means: these are still preliminary findings, not a final technical postmortem. Binance’s exact wording was “may have involved.” They broadly align with Blockaid’s preliminary assessment mentioned in the previous post—that the signing infrastructure was “misused”—in that neither points to stolen private keys. But these are still preliminary assessments from different sources. Don’t treat either as conclusive until Binance publishes its full postmortem.
Binance also provided its own impact figures for the first time: it estimates the total impact at about $6.3 billion, with roughly $3 billion frozen on-chain. The $6.3 billion figure is Binance’s own estimate. Previously, Binance had only provided the amount frozen, not a total loss or impact figure. Third-party Chainalysis estimated about $5.912 billion in the previous post. The figures are similar in scale but use different methodologies, so don’t conflate them. The $3 billion frozen is on the same scale as the roughly $3 billion cited at 08:52 in the previous post. There has been no new increase this round. Frozen does not mean recovered, much less reimbursed.
The reimbursement details are also more specific this time: Binance says it will cover all losses using the SAFU Fund and company funds, and that user funds are safe. It also pledged to publish an updated proof of reserves after remediation is complete. Actions already taken include revoking authorizations for affected addresses. What hasn’t changed: deposits and withdrawals remain suspended, and Alpha trading is still paused. He Yi said withdrawals would resume once security scans are complete, but no specific timeline has been given.
Market snapshot (checked against two independent sources before posting; Binance spot/OKX perpetual price difference ≤0.24%): $BTC at approximately $78,046 (24h -2.23%), $ETH at approximately $2,231 (-3.31%), and $BNB at approximately $717.69 (-3.81%). Compared with the snapshot in the 09:38 post ($BTC 77,134, $ETH 2,209, $BNB 699.79), all three are higher in absolute price, and $BNB is further from the low near 680. But this is just a rebound amid the incident, not a sign that it’s over.
My take: the suspected cause points to an internal endpoint and service container, rather than leaked wallet private keys. If confirmed by the final postmortem, the risk profile would narrow from “the wallet system was compromised” to “an internal access point was compromised.” But until the full postmortem is published and withdrawals resume, this remains an ongoing incident. If you have funds on Binance, don’t trust any “recovery links” from unofficial sources. Use only Binance’s official channels.
Risk disclaimer: The above summarizes public reporting and official statements and does not constitute investment advice. Preliminary findings may be revised in a later postmortem, and the incident is still developing.
Which are you more eager to see first: withdrawals resuming or the full technical postmortem?
#Binance #安全事件 #热钱包 #WithdrawalsSuspended
The top priority in my next-round list in the previous post (09:38)—item ④—has now materialized. This morning Beijing time, Binance published preliminary findings on X: the incident “may have involved the compromise of a DevOps engineer’s laptop.” The attacker used it to access a service container and submit unauthorized withdrawal transactions. Binance also explicitly stated: “We have found no evidence that any wallet private keys were compromised.”
First, let’s be clear about what this means: these are still preliminary findings, not a final technical postmortem. Binance’s exact wording was “may have involved.” They broadly align with Blockaid’s preliminary assessment mentioned in the previous post—that the signing infrastructure was “misused”—in that neither points to stolen private keys. But these are still preliminary assessments from different sources. Don’t treat either as conclusive until Binance publishes its full postmortem.
Binance also provided its own impact figures for the first time: it estimates the total impact at about $6.3 billion, with roughly $3 billion frozen on-chain. The $6.3 billion figure is Binance’s own estimate. Previously, Binance had only provided the amount frozen, not a total loss or impact figure. Third-party Chainalysis estimated about $5.912 billion in the previous post. The figures are similar in scale but use different methodologies, so don’t conflate them. The $3 billion frozen is on the same scale as the roughly $3 billion cited at 08:52 in the previous post. There has been no new increase this round. Frozen does not mean recovered, much less reimbursed.
The reimbursement details are also more specific this time: Binance says it will cover all losses using the SAFU Fund and company funds, and that user funds are safe. It also pledged to publish an updated proof of reserves after remediation is complete. Actions already taken include revoking authorizations for affected addresses. What hasn’t changed: deposits and withdrawals remain suspended, and Alpha trading is still paused. He Yi said withdrawals would resume once security scans are complete, but no specific timeline has been given.
Market snapshot (checked against two independent sources before posting; Binance spot/OKX perpetual price difference ≤0.24%): $BTC at approximately $78,046 (24h -2.23%), $ETH at approximately $2,231 (-3.31%), and $BNB at approximately $717.69 (-3.81%). Compared with the snapshot in the 09:38 post ($BTC 77,134, $ETH 2,209, $BNB 699.79), all three are higher in absolute price, and $BNB is further from the low near 680. But this is just a rebound amid the incident, not a sign that it’s over.
My take: the suspected cause points to an internal endpoint and service container, rather than leaked wallet private keys. If confirmed by the final postmortem, the risk profile would narrow from “the wallet system was compromised” to “an internal access point was compromised.” But until the full postmortem is published and withdrawals resume, this remains an ongoing incident. If you have funds on Binance, don’t trust any “recovery links” from unofficial sources. Use only Binance’s official channels.
Risk disclaimer: The above summarizes public reporting and official statements and does not constitute investment advice. Preliminary findings may be revised in a later postmortem, and the incident is still developing.
Which are you more eager to see first: withdrawals resuming or the full technical postmortem?
#Binance #安全事件 #热钱包 #WithdrawalsSuspended
