Binance said its ongoing probe into Thursday’s $6.3 billion security breach has uncovered additional points of compromise beyond the DevOps engineer’s laptop initially identified as the likely entry point. The exchange said outflows stopped when it paused withdrawals and that the service remains on track to resume within 45 hours while deposits operate normally.
The update follows CEO Richard Teng’s statement that the exploit was not a “one-click” action and went beyond a single employee’s access permissions after the attacker gained entry to an internal service container to submit unauthorized withdrawal transactions without leaking wallet private keys. Stablecoin issuers and blockchain partners have frozen about $3 billion of the stolen assets, and Binance pledged to cover all remaining losses using its SAFU insurance reserve and corporate funds.
Blockchain analytics firms TRM Labs, Chainalysis and Pangolin Intelligence attributed the record crypto theft to North Korea’s TraderTraitor hacking group. Onchain investigator ZachXBT reported that stolen funds from the Binance breach were routed through THORChain and commingled at the same wallet address as proceeds from last month’s $388 million Bitget exploit, which was also linked to TraderTraitor.