Binance responded to the theft incident, stating that no private key leakage has been found so far

Binance customer service representative Sisi responded to community questions on social media, stating that this attack was not an event that could be completed through a single device; the starting point of the attack was a compromised employee's computer. Attacks on cryptocurrency institutions are usually highly targeted, and attackers often attempt to use complex methods to implement infiltration. Binance has discovered important clues related to the incident and has taken measures to control risks. Relevant investigations and tracing are still ongoing, and the platform's core risk control and emergency mechanisms have been activated.

Regarding whether the engineer's permissions are too extensive, Sisi stated that this is not an incident where the attacker could directly use a specific engineer's permissions to complete a fund transfer, nor is it the result of a single person being able to operate with one click; the related anomalies involve a more complex attack process. At this stage, the investigation has not attributed responsibility to any individual, and the company will assume corresponding responsibilities while continuing to promote subsequent handling and security upgrades.

Currently, there is no evidence of wallet private key leakage. The total losses from this incident will be fully borne by the SAFU fund and company funds, with no need for users to bear any costs. Approximately $3 billion in affected assets have been frozen on-chain, and Binance is cooperating with law enforcement and blockchain intelligence agencies to trace the funds, which are publicly traceable on-chain. Deposits are fully open and unaffected; withdrawals have been suspended as a precautionary measure and are expected to reopen within 48 hours, with specific timing subject to official announcements. Binance will continue to update progress while ensuring the accuracy of the investigation and will publish detailed information and further security reinforcement measures after the incident is handled and reviewed.