Cryptocurrency exchange Binance has identified multiple points of compromise in a cyber attack that saw an estimated US$6.3bn (£4.7bn) transferred from its wallets, as investigations continue into one of the largest cryptocurrency thefts on record.

Its initial investigation had suggested that a compromised DevOps engineer’s laptop may have enabled an attacker to access a service container and submit unauthorised withdrawal transactions. However, the latest findings indicate that this was not the only point of compromise. Binance has not yet disclosed details of the additional breaches, and said it had found no evidence that wallet private keys were leaked.

Blockchain intelligence firm TRM Labs estimates that approximately US$6.36bn was transferred from Binance wallets across ten blockchains, with most of the activity occurring within around 20 minutes. TRM has attributed the attack to TraderTraitor, a North Korean state-linked hacking group, although Binance has not confirmed the identity of those responsible.

The attackers are believed to have compromised the exchange’s transaction-signing infrastructure, enabling them to authorise transfers from affected wallets. Around US$3bn (£2.3bn) of assets have so far been frozen on-chain through collaboration between Binance, stablecoin issuers and other industry partners.

Binance said deposits remain operational, while withdrawals have been temporarily suspended as it completes security work on the withdrawal service and related addresses. It expects withdrawals to resume within 48 hours of its latest update.

The exchange has pledged to cover all losses through its secure asset fund for users and company resources, and says customer funds remain safe. It says it will publish a full technical post-mortem and an updated proof of reserves once remediation is complete.

---