Up to $5.8 billion may have been drained — which would make it the largest exchange hack on record

'Problem likely lies in signature control system, not private key theft'

[Provided by Binance]
[Provided by Binance]

Binance, the world's largest digital asset exchange, suspended all deposits and withdrawals Friday after allegations of a massive hack surfaced, pledging to cover any user losses in full as stablecoin issuers moved to freeze suspected stolen assets.

Binance said in an official statement that it had halted all transactions "as a precautionary measure to conduct security checks, freeze assets and cooperate with law enforcement." The exchange added that it was "working around the clock to resolve the issue and will cover all losses."

Binance said it plans to release a report detailing the cause of the incident and its response once the investigation is complete. "User assets are safe," the exchange said, adding that it would provide ongoing updates through official channels.

The suspension came after large amounts of assets were moved out of Binance's hot wallets, triggering hack allegations. Overnight, multiple analysts estimated that assets suspected of having been drained from Binance-linked wallets totaled between $5.3 billion and $5.8 billion. Binance has yet to disclose the actual scale of losses or the specific circumstances of the alleged breach.

Industry players have also moved to block the suspected stolen funds. Tether, Circle, World Liberty Financial and Ripple have frozen a combined total of more than $2.59 billion in assets. The security committee of Arbitrum, an Ethereum layer-2 network, separately froze roughly $30.5 million in assets linked to the alleged Binance hack.

Binance said the total amount it has officially confirmed as frozen so far stands at $3 billion. "We are working closely with law enforcement, issuers, blockchain analytics firms and partners to freeze additional assets," the exchange said.

Cryptocurrency exchanges typically verify incoming deposits before crediting user accounts. Assets scattered across multiple deposit addresses are later moved in part to cold wallets and hot wallets designated for withdrawals. Because these fund transfers occur automatically, a compromised hot wallet that continues to receive incoming assets poses a significant risk of compounding losses.

If the hack allegations are confirmed, the incident would be the largest ever recorded at a centralized exchange. Bybit suffered a hack of approximately $1.5 billion in February last year. A confirmed $5.8 billion breach at Binance would be roughly 3.9 times larger than that record.

Kim Tae-il, chairman of the Digital Financial Crime Response Research Institute, said it was difficult to attribute the hot wallet breach to a single cause, but added that "the problem appears to have occurred not in the leakage of private keys but in the process of controlling the signatures required for transactions."

On the estimated loss figure of up to $5.8 billion, Kim said it was derived by "tracking and adding up funds moved from the hot wallets to other wallets," and noted that the total "may include transfers Binance itself made to move assets to safer wallets in order to prevent further outflows, beyond what was actually stolen."


kyoung@heraldcorp.com