Binance Says Employee PC Breach Was Only the First Step in Attack

Binance says a compromised employee computer was only an initial foothold in its security incident, as it keeps withdrawals paused and expects them to resume within 48 hours.

The exchange's customer service representative sisi described the computer breach as the start of the intrusion, not a standalone way to move funds. She said attackers often use more complex methods and that investigators had identified important leads and taken steps to contain the risk. The investigation has not assigned responsibility to any individual, she said.

Sisi said Binance had found no evidence that wallet private keys were exposed and that user funds remained safe. She also said the company would cover all stolen losses through its SAFU fund and company funds.

About $3 billion in affected assets have been frozen on-chain, and Binance is working with law enforcement and blockchain intelligence organizations to track them, sisi said. Deposits remain available, while withdrawals were suspended as a precaution. Binance expects withdrawals to return within 48 hours and plans to share further updates as the investigation progresses.