Binance is investigating a security breach involving one of its Ethereum wallets, with an estimated total impact of $6.3 billion. The exchange confirmed that deposits are operating normally, with withdrawals expected to resume within 48 hours as it completes a security revamp of its withdrawal service.
Scope of the Breach
Binance said the verified total value of crypto frozen is $3 billion, though this figure could increase as investigators trace additional assets. Multiple stablecoin issuers have frozen holdings linked to the hack, including Tether, which froze over $1.567 billion in USDT, and Circle, which froze more than $800 million in USDC.
Frozen assets include Tether USDt, USDC, Ripple USD, World Liberty Financial USD, StraitsX USD, Wrapped Beacon ETH, Tether Gold, Pax Gold, Pax Dollar, and Arbitrum tokens.
Suspected Attribution
Cybersecurity analysts suspect North Korea's TraderTraitor is behind the attack. Chainalysis co-founder and CEO Jonathan Levin cited links to a previous hack in attributing the breach to the group. TRM Labs attributed the attack to TraderTraitor with high confidence based on robust on and off-chain intelligence.
The FBI previously named TraderTraitor as responsible for the ByBit hack in February of the previous year. Onchain investigator ZachXBT noted that stolen funds from both the Binance attack and an earlier Bitget exploit were commingled in the same address, suggesting the same actor is likely behind both incidents.
Attack Method
Binance's initial investigation pointed to a compromised DevOps engineer's laptop as a potential entry point. The exchange said the laptop compromise may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Binance stated it found no evidence of a wallet private-key leak, though its investigation remains ongoing.
Blockaid co-founder Ido Ben-Natan said preliminary assessment pointed to key misuse, in which attackers manipulate the exchange's transaction-signing signature to authorize malicious transactions without extracting the underlying private key.
Market Impact
Following the disclosure, Bitcoin traded near $76,937, down 4.9% over 24 hours. BNB fell 8% to approximately $693, while Ether declined 5.7% to about $2,211. DeFi tokens also declined, with AAVE down 11.3% and Uniswap's UNI down 10.7% over the same period.
The Bitcoin Fear and Greed Index fell to fear with a score of 30, a level not seen since August.
Industry Response
Crypto trading firms Wintermute and GSR disclosed exposure to Binance but said they did not expect major disruption to their businesses. GSR CEO Xin Song said the firm's Binance exposure was less than 5% of its net equity, while Wintermute CEO Evgeny Gaevoy said exposure was less than 20% of net equity.
Binance co-founder Changpeng Zhao said he expected all user funds to be fully covered.
