Saw a few discussions about size of hack, why impact to bitcoin price is small, etc. 👇 $6.3 billion is the biggest in USD terms, but not in BTC terms. MtGox was 650,000 BTC! Other important numbers to consider: % of bitcoin (in relation to BTC total supply), ie, market impact. MtGox is big there again at 5%+. Number of users impacted, and % of user assets impacted. MtGox (the largest CEX at the time) and FTX (not small) were all near 100% of users and their asseets. Most important: Who is impacted? Does the platform cover it all? (only one victim), as in recent two CEX cases and Binance. Obviously, still a major disaster for the industry, Binance (and me). It hurts, but we survive. Most importantly, we protect our users. (image from @MatthewRoszak)
Key people 20 posts
What Binance leaders, security experts, token issuers and affected projects said about the incident. One column per person or group, each a timeline with the newest post first. Every column links to the full timeline on X.
How to read this page
- Phone: swipe left or right to change person. The bar at the top follows you and jumps to a column when tapped.
- Desktop: scroll the columns sideways, or click a name in the bar.
- Binance accounts come first. The next three columns are groups of outside voices, with the reason for each.
- "post text" is the full post. "post excerpt" is the first part of the post, quoted exactly. "summary" means we hold only our own summary, not the post text.
- Every post links to the original. A post that carries no stated time says "date not stated in source".
Seems token recovery already began. Another little detail in addition to the effort described, users pay trading fees on Binance in the coins they trade, so Binance's naturally accumulates all tokens they list. Your funds are SAFU!
Rough math: $6.x b hack, $3b frozen, $1.x b SAFU fund Gap is about $2b, we have $1.x billion in SPCX alone. Remaining gap is (still painful, but) manageable. 🙏
Elon, have a lot of respect for you, but bad time to troll. Please stop. Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support. Thanks!
User funds are SAFU.
Binance’s SAFU fund and Binance’s holdings include a large amount of assets such as BTC and ETH. We are currently buying, through OTC and on-exchange, all the stolen altcoins in fully matching amounts. We will update everyone again once the purchases are complete.
Reporting to the major shareholder: Our company’s revenue for the year is sufficient to cover the losses, so we do not yet need to sell the SpaceX shares you are bullish on.💁♀️
**Service Update** Deposits remain unaffected and continue to operate as normal. Our team is currently working on enhancements to the withdrawal service and related address controls. We expect to begin resume withdrawal services in the next 48 hours. We will continue to share updates through official Binance channels as progress is made.
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds. The company has already publicly committed to cover losses through company funds in the prior announcement. Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted. We are completing the purchase of the remaining amount by buying token assets through market channels and OTC channels. We are doing this to match the format of the remaining token assets and address any asset shortfalls. This step can take longer because some tokens may have low liquidity and OTC settlement also takes time. We will share more progress as soon as we can. These figures do not include frozen or protected assets, which remain subject to ongoing recovery and verification. Currently, $3bn has been frozen, with thanks to our industry partners. We are working with partners and law enforcement to recover the frozen assets.We will continue to use company resources to cover confirmed shortfall and will provide further verified updates as recovery efforts progress. Ultimately, all user funds will be verified publicly through our Proof of Reserves. We will weather this storm. Thank you for the support.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected. The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far. We will continue to provide further updates through official Binance channels as more verified information becomes available.
Service Update Deposits remain unaffected and continue to operate as normal. Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours, and will update with further details. The incident stems from multiple factors. Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident. A comprehensive report with the root cause will follow. We will continue to share updates through official Binance channels.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.
We are working non-stop to resolve this issue. Binance will cover all losses. As a precaution, all deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We are working around the clock and will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates. This is an industry-wide effort, and we are grateful to partners across the ecosystem who have moved quickly to help freeze affected assets. We will continue to share verified updates through official Binance channels. User funds are safe.
We are aware of differing figures circulating publicly regarding the amount frozen, including references to $1.8 billion. For clarity, the current verified total frozen is $2.54 billion. This figure may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets. We will only share confirmed figures and will provide further updates as more verified information becomes available.
Why this column: They trace the stolen funds and publish running totals of what was frozen.
@zachxbt
Update: This brings the total frozen for the Binance exploit so far to over $2.83B
Why this column: Only an issuer can freeze its token, so its post is the first public number for frozen funds.
@ZachWitkoff
USD1 has taken proactive steps to freeze the $27 million in USD1 associated with the @binance hack. We stand by our industry partners. Protecting users and preventing bad actors from moving stolen funds is a shared responsibility.
@paoloardoino
Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone.
@jerallaire
Circle's chief executive posted that more than 800 million USDC was frozen.
Why this column: They show what the attack cost others: a rescue of funds on a network, a paused lending market.
@arbitrum
The Arbitrum Security Council has taken emergency action to rescue the 74,559,805 ARB and 8,425 ETH being held in the address on Arbitrum One that is identified as connected to the Binance exploit.
@aave
Scope: all V3 and V4 markets run by community governance. Existing positions can still withdraw and repay. Aave says its contracts are not affected.