Binance traces $6.3 billion security incident to service access

Binance says a suspected security incident may have let an attacker use a compromised engineer’s laptop to submit unauthorized withdrawal transactions, with an estimated $6.3 billion impacted. The exchange’s initial account is that the laptop gave the attacker access to a service container, a software environment used to run an internal service. Binance says it has found no evidence of a wallet private key leak. The Associated Press reported that the exchange was investigating the incident and had worked with blockchain partners to freeze affected assets.

How could a laptop lead to unauthorized withdrawals?

Binance’s initial explanation describes a path through several connected parts. First, an attacker may have gained access to a DevOps engineer’s laptop. DevOps staff work on the systems that build, deploy and maintain software. From the laptop, the attacker may then have reached a service container, a packaged environment in which software runs. Binance says that access may have allowed the attacker to submit withdrawal transactions without authorization.

A withdrawal transaction instructs a blockchain network to move assets from one address to another. The company has not published a complete account of how the attacker passed the checks that normally authorize such requests. Binance says the incident involved multiple factors and that it is tracing the path through the compromised computer. The laptop and container are parts of its reported theory; they do not yet amount to a full technical explanation.

What does Binance mean by $6.3 billion impacted?

The $6.3 billion figure is Binance’s estimate of the incident’s total impact. It should not be read as a confirmed amount stolen: the exchange has not published a final loss figure, and its investigation is ongoing. Binance says roughly $3 billion in affected assets has been frozen on-chain. Freezing assets can prevent some transfers from proceeding, but it does not by itself establish how much was taken or recovered.

Binance says it is working with law enforcement, token issuers, blockchain intelligence firms and other industry partners to trace and freeze more assets. Stablecoin issuers can sometimes block transfers of their tokens when they identify addresses linked to an incident. The company has not provided a final breakdown of the affected assets in its initial explanation.

Are deposits and withdrawals operating?

In its October 30 update, Binance said deposits were operating normally, while withdrawals remained paused as it reviewed and revamped the withdrawal service and related addresses. It said it expected withdrawals to resume within 48 hours. Binance also said it would cover losses from its SAFU fund and company resources, and publish a post-mortem and updated proof of reserves after remediation. Those are company commitments; the technical findings and final account of losses were still pending.

Source material

• The Associated Press reported — apnews.com