Binance finds more breach points as withdrawals stay suspended
The exchange estimates a $6.3 billion impact and says it will cover losses. A withdrawal restart depends on security testing.
Binance said its investigation into a security incident affecting about $6.3 billion in digital assets had uncovered additional points of breach, widening the inquiry beyond an initially suspected compromised employee laptop. Withdrawals remain suspended while the cryptocurrency exchange rebuilds and tests its systems.
The exchange says deposits are unaffected and it will cover losses through its SAFU emergency fund and company funds. That is a commitment by Binance, not confirmation that every affected asset has already been recovered or that customers can withdraw normally.
The investigation is broader than one laptop
Binance's initial account said an attacker gained access to a service container and submitted unauthorized withdrawal transactions after a DevOps engineer's laptop was compromised. The company said it had found no evidence of a wallet private-key leak.
Co-CEO Richard Teng subsequently said investigators had identified other breach points and were still assembling the full sequence of events. He cautioned that the attack was complex, not simply a single click or the use of one engineer's permissions, and said the investigation had not attributed responsibility to an individual.
Binance estimated that about $3 billion in affected assets had been frozen on-chain with help from partners. Frozen assets are not the same as money already returned: recovery and verification remain part of the response.
A reopening target, not a guarantee
Teng said Binance was targeting a Sunday restart for withdrawals, but would not switch the service back on until it passed rigorous testing. The security review covers employee devices, cloud systems, key management and transaction-signing procedures, according to CoinDesk's reporting, not independently confirmed.
The exchange also plans to publish an updated proof-of-reserves report. The promised report and reopening target are future steps, not evidence that remediation is finished.
The distinction matters for customers: a promise to absorb losses does not remove the immediate restriction on moving assets off the platform. The current investigation also does not establish that a leaked private key was the cause. Binance has said the opposite about the evidence it has found so far, while acknowledging that the full attack path is not yet known.
The incident concerns Binance.com. Binance.US said its separate platform was not affected, according to the BBC's reporting, not independently confirmed.
