Pete Reviews Binance’s $6.3 Billion Incident as Investigation Expands

Binance estimated the total impact of its security incident at approximately $6.3 billion in an announcement examined by Learn Cardano host Pete. His video follows the initial reports of large wallet outflows, efforts to freeze affected assets and the exchange’s response.

The preliminary findings presented in his coverage focused on a potentially compromised employee laptop. Binance subsequently expanded that account, reporting additional points of breach and describing a more complex attack process.

Large Transfers From Binance Operational Wallets

Pete’s coverage begins with reports of approximately $5.6 billion to $5.7 billion moving from Binance-linked wallets across networks including Ethereum, Bitcoin and Tron. He outlines a sequence involving several operational wallets and substantial transfers of ETH, USDT and USDC.

These internet-connected wallets, commonly called hot wallets, support an exchange’s everyday transaction processing. The activity discussed in the video involved Binance-controlled wallets and the infrastructure used to authorize withdrawals.

The reported scale changed as information became available. Near the end of the recording, Pete incorporated Binance’s announcement estimating the total impact at approximately $6.3 billion. That figure superseded the earlier estimates discussed at the beginning of his update.

Stablecoin Freezes and Binance’s Response

Efforts to restrict the movement of affected assets form a central part of Pete’s account. He highlights reports of approximately 1.567 billion USDT being frozen, alongside hundreds of millions of dollars in USDC. Binance later put the combined value of frozen assets at around $3 billion.

Freezing tokens prevents their movement from affected addresses. Recovery and return of those assets are separate steps, so the frozen amount does not represent funds already restored to the exchange.

An announcement presented in the video described a temporary suspension of deposits and withdrawals while Binance conducted security checks. The exchange outlined cooperation with law enforcement, token issuers, blockchain intelligence firms and industry partners to trace assets and secure additional freezes.

Binance also committed to covering losses through its Secure Asset Fund for Users, known as SAFU, and company funds. Pete discusses that pledge alongside questions about the financial resources available to meet it.

His security coverage extends to impersonation attempts surrounding the incident. He describes how fraudulent emails and messages could imitate Binance announcements, using purported account updates or recovery instructions to direct users toward phishing links.

[NEWSBREAK]

Investigation Extends Beyond the Initial Laptop Finding

The preliminary explanation examined in Pete’s video suggested that a compromised DevOps engineer’s laptop may have enabled access to a service container and the submission of unauthorized withdrawal transactions. A service container is an isolated software environment that runs a particular application or service.

Binance stated that it had found no evidence of wallet private key leaks. Its initial account therefore focused on access to internal systems used in transaction processing, with a detailed technical explanation reserved for the investigation’s completion.

A subsequent update identified additional breach points. Binance described the incident as a complex attack that could not be reduced to a single computer or a one-click action using one engineer’s permissions. The company also stated that the investigation had not attributed responsibility to an individual.

The exchange committed to publishing a technical post-mortem once the investigation was complete and the facts verified. Its announcement also included plans to publish an updated Proof of Reserves after remediation.