Binance Finds 'Additional Points of Breach' in $6.3 Billion Hack

Binance now puts the damage from Thursday's security incident at roughly $6.3 billion, and says its investigation has uncovered "additional points of breach" beyond the compromised laptop it originally blamed. About $3 billion of the affected assets has been frozen onchain with the help of blockchain partners, the exchange said on Friday. Losses will be covered in full by its SAFU emergency reserve and company funds.

The admission changes the story. Binance's first announcement, late Thursday, described a single entry point: a compromised DevOps engineer's laptop that may have let an attacker reach a service container and submit unauthorized withdrawal transactions. "We have found no evidence of any wallet private key leak," the exchange said at the time.

By Friday, that framing was gone. CEO Richard Teng wrote that the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action," describing "a more complex attack process." He added: "Our investigation has not attributed responsibility to any individual." Binance's own update called it "a complex attack" and said the facts were still being gathered.

How much was actually taken?

Blockchain analytics firm Arkham puts the haul at $6.01 billion, drained from Binance hot wallets across nine blockchains between 4:10 p.m. and 7:05 p.m. ET on Thursday. Issuers had frozen $2.80 billion of that amount, Arkham said, but roughly $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens could still be moved.

The attacker has not stopped moving funds. Early Friday, the wallets sent $38.82 million in Ethereum to a new address while still holding $1.12 billion in ETH, according to Arkham. Hours later, a Tron address Arkham tagged as belonging to the attacker moved about $2.1 million in TRX to nine new addresses across 14 transfers. As of Friday morning, Arkham's entity page showed the attacker holding about 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL, alongside frozen stablecoin balances.

Stablecoin issuers acted fast once the funds left the exchange. Tether and Circle froze approximately 975.1 million USDT and 823 million USDC in the main receiving wallet — about $1.8 billion combined — Decrypt reported Thursday, when an onchain tally still put the drain at $5.57 billion. Binance co-founder Changpeng "CZ" Zhao publicly thanked the two issuers for their "quick freeze."

What does this change for users?

Deposits are back. Teng said Friday morning that deposits were "operating as normal," but withdrawals remain suspended while Binance completes "a security revamp of the withdrawal service and its related addresses." The exchange has also revoked the affected address authorization and is working with law enforcement and blockchain intelligence firms to trace and recover the funds. Outflows stopped when withdrawals were paused, and Binance says it remains on track to resume them within 45 hours.

Teng addressed users directly. "Bottom line - your money is safe, and we're covering every loss," he wrote. He also committed to transparency once the investigation wraps: "We'll share a detailed technical post-mortem once the investigation is complete and every fact is verified—and publish an updated Proof of Reserves once remediation is complete."

For the broader market, the incident's operational fallout is still unfolding. The largest exchange hack on record has already forced the fastest coordinated stablecoin freeze to date, and the gap between Binance's $6.3 billion estimate and Arkham's $6.01 billion onchain tally signals the full scope is not yet settled. Whether Binance meets its 45-hour withdrawal deadline — and what its refreshed Proof of Reserves shows — will set the benchmark for how much counterparty risk the market prices into centralized custody.