Binance responded to the theft incident, stating that no private key leakage has been found so far
Binance customer service representative Sisi responded to community questions on social media, stating that this attack is not an incident that can be completed through a single device; the starting point of the attack was a compromised employee's computer. Attacks on cryptocurrency institutions are usually highly targeted, and attackers often attempt to use complex methods to implement infiltration. Binance has discovered important clues related to the incident and has taken measures to control risks. Relevant investigations and tracing are still ongoing, and the platform's core risk control and emergency mechanisms have been activated.
Regarding whether the engineer's permissions are too extensive, Sisi stated that this is not an incident where the attacker can directly utilize a specific engineer's permissions to complete a fund transfer, nor is it the result of a single person being able to operate with one click; the related anomalies involve a more complex attack process. At this stage, the investigation has not attributed responsibility to any individual, and the company will assume corresponding responsibilities while continuing to promote subsequent handling and security upgrade work.
Currently, there is no evidence of wallet private key leakage. The total losses from this incident will be fully covered by the SAFU fund and company funds, and users will not bear any losses. Approximately $3 billion in affected assets have been frozen on-chain, and Binance is cooperating with law enforcement and blockchain intelligence agencies to trace the funds, which are publicly traceable on-chain. Deposits are fully open and unaffected; withdrawals have been suspended as a precautionary measure and are expected to reopen within 48 hours, with the specific time subject to official announcements. Binance will continue to synchronize progress while ensuring the accuracy of the investigation and will publish detailed information and further security reinforcement measures after the incident is handled and reviewed.
