Global cryptocurrency giant Binance has confirmed it suffered the largest cyber-attack in history, resulting in $6.3bn of cryptocurrency being stolen.
The Chinese-founded, Dubai-headquartered and Delaware-registered company said it has frozen $3bn of stolen funds and that it will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds.
According to a company statement on October 30, its investigation suggested that an attacker’s entry point may have been a compromised Binance development and operations (DevOps) engineer’s laptop.
This allegedly allowed the attacker to gain access to a service container and submit unauthorized withdrawal transactions.
However, Binance has since revised that assessment and said its subsequent investigation uncovered additional points of breach.
“This was a complex attack,” the company said, adding that it was working with law enforcement, blockchain intelligence firms, token issuers and other industry partners to establish the full circumstances as well as identify and recover affected assets.
Binance has not yet provided a definitive account of the attack, saying it is still gathering the facts and will publish a comprehensive technical post-mortem once the investigation is complete.
The company has said it has found no evidence that any wallet private keys were leaked.
In its many updates on social media, the exchange has repeatedly stressed that customer funds remain safe, despite the scale of the incident. It has also promised to publish an updated proof of reserves once remediation work is complete, providing customers with an updated view of the assets held against user balances.
Three world-leading cryptocurrency analysis firms, TRM Labs, Elliptic and Chainalysis have attributed the attack with “high confidence” to TraderTraitor, a North Korean hacking group.
Binance Suspends Withdrawals as Investigation Continues
As the investigation progressed, Binance introduced a series of precautionary measures.
These included the temporary suspension of all deposits and withdrawals, as well as Binance Alpha trading activities, specifically CEX Buy Token, Alpha Instant and CEX purchase prediction marketing activities using funds in users’ spot wallets.
In its latest update, however, Binance clarified that deposits have resumed normal operations and remain unaffected.
Withdrawals remain suspended at the time of writing while the company completes a security revamp of its withdrawal service and related addresses, with resumption expected within 45 hours.
The company also confirmed that unauthorised outflows ceased after withdrawals were paused. It has revoked the affected address authorisation and continues to work with law enforcement and blockchain partners to trace and freeze the affected assets.
Binance customers are advised to remain alert to potential scams exploiting the incident. Binance has specifically warned users not to trust unofficial links, messages or requests for account information.
Customers have been advised to rely exclusively on its official communication channels for updates and to contact Binance Customer Support if they have questions.
Image credits: miss.cabul / K.unshu / Shutterstock.com