Binance Finds 'Additional Points of Breach' in $6.3B Hack

CEO Richard Teng said the attack was "not a single 'one-click' action," as Binance confirmed about $3 billion has been frozen.

The top 3

Mechanism of the Attack and Investigation Findings: Binance has clarified that the security incident was a complex, multi-stage attack rather than a simple 'one-click' action. While the initial investigation identified a compromised DevOps engineer's laptop as a point of entry, subsequent forensics uncovered additional breach points, though the exchange confirmed there was no evidence of a leak of wallet private keys.
Attribution and Onchain Tracking: Multiple cybersecurity research firms and investigators, including TRM Labs, Chainalysis, and ZachXBT, have linked the Binance hack to the North Korea-affiliated actor 'TraderTraitor' with high confidence. The attribution is based on the technical sophistication of the attack and the observation that stolen funds from both Binance and a previous Bitget exploit were commingled at identical onchain addresses after being laundered through the cross-chain protocol THORChain.
Asset Recovery and Mitigation: Approximately $3 billion of the affected assets have been frozen onchain, largely due to the cooperation of stablecoin issuers like Tether and Circle. Binance has committed to covering all user losses using its SAFU (Secure Asset Fund for Users) and company funds, while maintaining that user assets remain secure.