Binance responds: The theft was not carried out by compromising a single device or employee, and no evidence of wallet private key leakage has been found so far.

October 30: Binance customer service sisi responded to community questions on social media, stating:

This attack was not an incident that could be completed through a single device; the hacking of an employee's computer was the starting point of this attack. Attacks against crypto institutions are usually highly targeted, and attackers often attempt to use sophisticated methods to carry out infiltration.

Binance has discovered important clues related to the incident and has taken immediate measures to control the risk. The related investigation and tracing work are still ongoing. At this stage, the platform's core risk control and emergency response mechanisms have been activated. The safety of user assets is our top priority.

Regarding the question of whether "engineers have excessive permissions," sisi stated that this was not an incident in which the attacker could complete the transfer of funds simply by exploiting a certain engineer's permissions, nor was it the result of a single person being able to "operate with one click." The related anomalies involve a more complex attack process. It must be emphasized that, at this stage, the investigation has not attributed responsibility to any individual. The company will bear the corresponding responsibility and will continue to advance follow-up handling and security upgrades.

In addition, no evidence of wallet private key leakage has been found so far. User funds are safe. All stolen losses caused by this incident will be fully covered by the SAFU fund and company funds, and users will not need to bear them. Currently, approximately $3 billion in affected assets has been frozen on-chain. Binance is cooperating with law enforcement agencies and blockchain intelligence institutions in the investigation, and the on-chain flow of funds is publicly verifiable.

Deposits remain fully open and unaffected. Withdrawals have been suspended as a preventive measure and are expected to reopen within 48 hours, with the specific time subject to official announcements. Binance will continue to provide progress updates while ensuring the accuracy of the investigation, and will publish detailed information and further security hardening measures after the incident handling and review are completed.