- Binance said it had found "additional points of breach" in the $6.3 billion crypto heist.
- Binance said it has begun recovering some assets in what appears to be the largest ever crypto heist.
- Two crypto tracing firms linked the attack to a North Korean hacking group.
Binance said it has "uncovered additional points of breach" in an attack in which hackers stole up to $6.3 billion in cryptocurrency.
The crypto exchange initially said the incident may have stemmed from an engineer's compromised laptop, but in a Friday morning update said further investigation had found the "complex attack" went beyond that.
A Binance spokesperson said that it is working with law enforcement to resolve the attack, which appears to be the largest ever crypto heist. They added that they would share a "detailed technical postmortem once the investigation is complete."
Major cryptocurrencies were trading lower following the hack, which caps a month full of other high-profile security incidents across the business world.
Here's what we know so far about the Binance hack.
What is happening with user funds?
The company said that user funds are "safe," and that it will cover all losses using its Secure Asset Fund for Users and company funds.
"Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds," the company said in a Friday morning X post.
Binance added that it has reserved over $6.34 billion of company funds to cover the incident.
Customers can still make deposits as usual, and the company said in an earlier post on Friday that it expects to resume the withdrawal service within 45 hours.
Binance said it has worked with other blockchain partners to freeze around $3 billion in assets so far. All outflows of funds stopped when Binance paused its withdrawal service, the company said.
Who is behind the Binance hack?
Binance has not yet commented on who is responsible.
TRM, a crypto tracing firm, said in a blog post that it had "high confidence" that TraderTraitor, a North Korean hacking unit, was responsible for the heist. Last year, the FBI found that the same group was behind the $1.5 billion attack on Bybit, a Dubai-based cryptocurrency exchange.
Chainalysis also attributed the attack to TraderTraitor with a "high degree of confidence."
How did the hack unfold?
Binance initially reported the security breach on Thursday, saying that it "may involve a compromised DevOps engineer's laptop."
That laptop allowed the attacker to access Binance's systems and "submit unauthorized withdrawal transactions," the company said.
The attacker withdrew most of the funds within about 20 minutes, TRM's analysis of public crypto wallets found.
Changpeng Zhao, Binance's founder and former CEO, said in a Thursday post on X that it looked like a hack, and continued posting about the incident into Friday morning, reiterating that user funds are safe.
"Many industry friends and even competitors (including some previously-not-so-friendly ones) provided very much needed help," he said in a post.
A bruising month of hacks
The Binance hack is one in a string of cyber incidents this month.
On Thursday, Polymarket temporarily paused trading after some users reported unauthorized withdrawals; it said trading had resumed by 3 pm ET. There is no evidence that the hacks are related.
The AI coding company Cursor said in a post on X on Friday that a security incident involving a "malicious version" of Claude Code had impacted up to 5,000 users. Cursor, which is owned by SpaceX, said it had worked to "neutralize the malware," and that users were no longer at risk.
Earlier this month, AI helped discover two "critical" flaws in PHP, a programming language that up to 70% of websites use. The event sparked concerns about a rise in cyberattacks in the AI era.
The post Binance finds 'additional points of breach' in $6.3 billion crypto heist appeared first on Business Insider
