$6.3 billion was stolen in 40 minutes after two days of preparation: The complete timeline of the Binance hack | Live updatesSimply put, the attacker spent some time preparing openly on-chain, then used a single delegation via EIP-7702 to turn Binance’s hot wallet Binance 14 into a contract under their control, and began liquidating funds at dawn. By morning, assets worth approximately $5.643 billion had flowed from addresses linked to the Binance hot wallet across Ethereum, Bitcoin, Tron, and several Layer 2 (L2) networks. The issuers, including Tether, Circle, Ripple, and World Liberty, joined forces to freeze around $2.54 billion, or nearly 45% of the outflow. So far, the malicious delegation has not been revoked.
Binance’s official position so far is that it is investigating a potential security issue and that users’ funds are completely safe.
Binance responds: Funds were not stolen in this incident by compromising a single device or employee, and no evidence of wallet private key leaks has been found so far
On October 30, Binance customer service representative sisi responded to community questions on social media, explaining that this was not an attack that could be carried out using just one device, and that compromising an employee’s computer was the starting point of the attack. Attacks targeting cryptocurrency businesses are often highly targeted, with attackers typically attempting to infiltrate them using sophisticated methods.
Binance discovered significant evidence related to the incident and immediately took steps to contain the risks. The relevant investigation and efforts to trace the source of the attack are ongoing. At this stage, the platform’s core risk management and emergency response mechanisms have been activated, and the safety of users’ assets remains our top priority.
In response to the question, “Were the engineers’ permissions too broad?”, sisi said this was not an incident in which an attacker could transfer funds simply by exploiting the permissions of a particular engineer, nor was it something one person could cause with “the click of a button.” The compromise that led to these unusual activities involved a more complex attack. It is important to emphasize that, at this stage, the investigation has not attributed responsibility to any individual. The company will take appropriate responsibility while continuing to address the impact of the incident and strengthen security. In addition, no evidence of wallet private key leaks has been found so far. As for users’ funds, SAFU and the company will fully cover all stolen losses resulting from this incident, and users will not be asked to bear any of them. To date, approximately $3 billion in affected assets has been frozen on-chain. Binance is working with law enforcement and blockchain intelligence firms to trace them, and anyone can publicly view the movement of funds on-chain.
Deposit services are available as usual and have not been affected. Withdrawals have been suspended as a precaution and are expected to resume within 48 hours; please refer to official announcements for the exact timing. Binance will continue to share updates while ensuring the investigation is accurate, and will announce details and additional security measures after the incident has been fully addressed. SlowMist: Binance’s attackers are likely from North Korea’s Lazarus Group
BlockBeats reported that on October 30, SlowMist posted on social media that it had detected stolen TRX being transferred through the Bitget Wallet cross-chain bridge as part of Binance hackers’ money laundering operation, and that this destination address had previously been used by Phemex hackers. Notably, the Phemex hackers were the same ones behind the Bybit attack: North Korea’s Lazarus Group.
He Yi: Withdrawal services are expected to begin resuming within the next 48 hours
He Yi, Binance’s co-CEO, posted on social media that deposits on the Binance platform have not been affected and are operating normally. The Binance team is currently improving and upgrading withdrawal services and related address control mechanisms, and withdrawals are expected to begin resuming within the next 48 hours.
Binance: SAFU fund and company funds will cover all losses
In its latest announcement, Binance confirmed that it will cover all losses resulting from the hacking incident using the SAFU fund and company funds. Binance reiterated that users’ funds are safe. After the recovery work is complete, it will also publish an updated proof of reserves. As an immediate precaution, Binance has temporarily suspended deposits and withdrawals pending the completion of security checks, revoked permissions for the affected addresses, and contacted law enforcement and its blockchain intelligence partners to trace and recover the funds.
Binance: Security incident may be related to the compromise of a DevOps engineer’s laptop, with the impact estimated at approximately $6.3 billion
On October 30, Binance issued an update on the security incident, saying that an initial examination suggests that a DevOps (development and operations) engineer’s laptop may have been compromised, allowing the attackers to access a service container and submit unauthorized withdrawal transactions. No evidence of wallet private key leaks has been found so far. The total impact is estimated at approximately $6.3 billion, and related assets have been frozen in cooperation with blockchain partners, including approximately $3 billion on-chain. Binance will cover all losses using the SAFU fund and company funds, and users’ funds are safe. Once the recovery work is complete, Binance will publish an updated proof of reserves.
As an immediate measure, Binance temporarily suspended deposit and withdrawal services to conduct security checks, revoked permissions for the affected addresses, and is working with law enforcement and its blockchain intelligence partners to trace and recover the funds. The full technical report will be published after the investigation and verification of the facts are complete. Please follow official channels for updates 
#Binance #BTC #bnb #ETH $BTC