Binance: A Hacked Employee Computer Is Only the Starting Point of an Attack, Attackers Often Use Sophisticated Means to Infiltrate

October 30: Binance customer service sisi posted an explanation of the technical details of the security incident. She said that a hacked employee computer was the starting point of the attack, but this is not an incident where breaching a single computer is enough to move funds out — attackers often use sophisticated means to infiltrate, and the company has found important clues and taken measures to control the risk. This is not a fund transfer that an attacker could complete simply by using a certain engineer's permissions, nor the result of a one-click operation by a single person; at this stage the investigation has not attributed responsibility to any individual.

sisi again emphasized that no evidence of wallet private key leakage has been found so far, user funds are safe, and all stolen losses are fully covered by the SAFU fund and company funds. About $3 billion of affected assets have been frozen on-chain, and the company is cooperating with law enforcement and blockchain intelligence agencies in the pursuit. Deposits have been normal throughout; withdrawals have been suspended as a precautionary measure and are expected to reopen within 48 hours. Going forward, progress will continue to be shared on the premise of ensuring the accuracy of the investigation, and detailed information as well as security hardening measures will be published.
Earlier news, Binance disclosed: the security incident may involve a compromised DevOps engineer's computer, no private key leakage found, total losses estimated at about $6.3 billion.