Crypto exchange Binance halts withdrawals after S$8 billion hack - Mothership
The platform has claimed that user funds are safe.
The world's biggest cryptocurrency exchange, Binance, suffered a hack on Oct. 30.
Approximately US$6.3 billion (S$8.05 billion) was impacted in what is possibly the biggest single financial hack in history.
The exact number is not yet known, with Binance still providing updates as the situation unfolds.
Binance has suspended user withdrawals and is in the midst of tracing the funds.
At 5:15am on Oct. 30, Binance founder and ex-CEO Zhao Changpeng, better known as CZ, claimed "It does look like a hack on Binance," in response to customer concerns raised online.
It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).
I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.
The hack sent cryptocurrencies tumbling, with bitcoin falling about 5 per cent, Ethereum 6 per cent, and Binance's token BNB dropping 10 per cent.
According to crypto news site Watcher.Guru, US$1.45 billion (S$1.85 billion) of bitcoin, US$875 million (S$1.11 billion) of Ethereum, and more than US$2 billion (S$2.55 billion) of stablecoins were affected, amongst other cryptocurrencies.
Stablecoins are cryptocurrencies that are pegged to the U.S. dollar.
Tether and Circle, two companies behind the USDT and USDC stablecoins respectively, have frozen the affected stablecoins in response.
However, most other cryptocurrencies such as bitcoin and Ethereum do not have a centralised authority behind them, and cannot be frozen.
The hacker therefore cannot be prevented from transacting those other cryptocurrencies.
According to crypto security firm Blockaid, the hacker targeted a Binance hot wallet, an account that an exchange uses to store funds to pay out user withdrawals.
The hacker gained access to the funds through the wallet's private key, which resembles a password needed to authorise transactions.
It is not known how they got access to the private key.
An official statement from Binance says that the hack may have originated from a compromised DevOps (development operations) engineer's laptop, denying that any private key was leaked.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
Binance co-CEO Richard Teng said at 8:22am that the company was investigating a "potential security issue".
He stressed that user funds "remain safe", though he did not elaborate further.
One user claimed that his account had been compromised, with about US$3 million (S$3.83 million) being withdrawn without his authorisation.
Binance co-founder Yi He announced that it will cover all losses.
Zhao added: "It hurts, but we will survive."
