Binance’s initial investigation indicated that the attacker may have accessed the system through an employee’s potentially compromised laptop and submitted unauthorized withdrawal requests.
In a Binance statement cited by CoinGlass, a DevOps engineer’s computer was identified as a possible starting point for the security incident. The employee’s device, used in software development and system operations, may have been compromised.
How might the attacker have submitted withdrawal requests?
According to the initial findings, this access may have allowed the attacker to reach the software environment where one of the exchange’s services runs and submit unauthorized withdrawal requests. The exchange has thus shared its initial technical assessment of how the attacker may have entered the system before the asset movements that were previously tracked on-chain.
The finding concerning the employee’s computer was presented not as the definitive conclusion of a completed investigation, but as a possible access route indicated by the initial assessment.
SAFU and company resources will cover the losses
CoinGlass’s post also said that Binance would cover all losses resulting from the incident using the SAFU fund and company resources, and that user funds were safe.
The exchange had previously temporarily suspended deposits and withdrawals, and co-CEO Yi He said the losses would be covered. We reported the details of the earlier statement; in its latest post, the possible point of entry into the system was highlighted alongside that commitment.
Not investment advice.