Binance discovered additional attack vectors beyond the initially reported compromised DevOps engineer's laptop in Thursday's security breach, which the exchange estimates cost $6.3 billion.
Binance CEO Richard Teng said on Friday that the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action," describing it as "a more complex attack process." The exchange said it found no evidence of wallet private key leaks.
Blockchain analytics firm Arkham measured the haul at $6.01 billion taken from Binance hot wallets on nine blockchains between 4:10 p.m. and 7:05 p.m. ET on Thursday. About $3 billion of affected assets has been frozen onchain with help from blockchain partners, while $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens remained moveable as of Friday.
Stablecoin issuers froze $1.8 billion in USDT and USDC held in the attacker's main receiving wallet. Binance co-founder Changpeng Zhao thanked Tether and Circle for their quick response.
By Friday morning, the attacker's wallets held approximately 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL, alongside frozen stablecoin balances. Early Friday, the attacker moved $38.82 million in Ethereum to a new address and later transferred about $2.1 million in TRX across nine new addresses.
Binance suspended withdrawals but resumed deposits by Friday morning. The exchange said it will cover all losses from its SAFU emergency fund and company funds, and plans to resume withdrawals within 45 hours.