Binance Hack Questions Deepen After Altcoin Sales
The suspected attacker behind the Binance breach converted a group of stolen altcoins into ether, with onchain reporting putting the proceeds at roughly $158 million. The activity unfolded while Binance’s explanation for the incident faced scrutiny from security researchers examining how transactions moved across multiple chains.
The sales do not settle the central question surrounding the breach. Binance has said its preliminary findings point to a compromised DevOps engineer laptop and that no wallet private keys were leaked, while an assessment cited by Bitcoin.com News indicates the attacker may have been able to direct the exchange’s hot wallet signing system to authorize transactions.
What happened
TradingView reported that the attacker sold UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD, accumulating 70,480 ETH worth about $158.25 million. Bitcoin.com News similarly reported that the attacker sold about $158 million in altcoins for 70,480 ETH.
TradingView identified several of the individual transactions. It said 7.02 million UNI were sold at about $5.65 for $39.63 million, while 217.5 million ENA were sold for $33.93 million. The outlet also reported sales of 7.77 trillion PEPE at about $0.0000041 for $31.66 million and 2.57 million LINK at about $10.14 for $26.05 million.
The token conversions matter because they show funds moving from a range of assets into ETH, rather than remaining in tokens that may be subject to different issuer or ecosystem controls. The reported sales involved seven tokens, although the available transaction details do not establish the full set of assets affected by the broader incident.
CoinDesk reported that Binance estimated the impact of the hack at around $6.3 billion and said $3 billion had been frozen, including $2.3 billion in USDT and USDC. Insurancejournal reported that Paolo Ardoino, Tether’s chief executive officer, said in an X post that more than $1.5 billion of the stablecoin had been frozen in connection with a potential Binance exchange hack.
Binance executives said they were investigating and that customer funds were safe, according to Insurancejournal. Gizmodo reported that a Binance spokesperson said the company was reviewing the potential security issue urgently and would provide updates through official channels once it had verified information.
Why it matters
The case combines a potentially large exchange loss with a live effort to stop assets from moving further through the crypto ecosystem. Freezes of stablecoins can limit the mobility of some funds, but the reported conversion into ETH illustrates the practical challenge of containing assets after they have moved among tokens and chains.
According to the background provided by Binance’s reported circumstances, the exploit involved more than $6 billion and would be the largest crypto exchange theft on record. It was described as equal to about 4% of Binance’s roughly $144 billion in pre-hack assets. The drained wallet was also counted in proof of reserves, making the incident relevant not only to transaction security but also to how exchange-held assets are represented.
The size of the reported freezes should not be treated as a final accounting of losses or recoveries. CoinDesk’s figure refers to Binance’s estimate and the amount frozen in its report, while Insurancejournal separately reported Tether’s statement about more than $1.5 billion. Those figures describe different claims and do not by themselves resolve the total amount ultimately at risk.
Binance’s ability to make customers whole is another important issue. The background notes that Binance pledged to cover losses through its roughly $1 billion Secure Asset Fund for Users, known as SAFU, and company funds. Insurancejournal described SAFU as an emergency insurance and reserve fund intended as a customer backstop in extreme situations.
Background and context
CoinDesk reported that Binance’s initial investigation suggested a compromised DevOps engineer laptop provided access to a service container that was then used for unauthorized withdrawals. The exchange said there was no evidence of a wallet private key leak.
That account remains contested. Bitcoin.com News reported that TRM Labs said wallets on nine other chains sent funds through ordinary signed transfers. TRM Labs assessed that the attacker likely could make Binance’s hot wallet signing system sign transactions of its choosing, according to the outlet.
The distinction is significant because the available accounts describe different possible points of failure. A compromised laptop and access to a service container, as described by Binance through CoinDesk, is not the same as a direct private key leak. At the same time, the multi-chain signed-transfer activity cited by Bitcoin.com News has prompted debate over whether keys were misused or compromised.
Attribution also remains unresolved. The background notes that a North Korea TraderTraitor or Lazarus connection has been assessed as likely, but has not been finally confirmed. No final attribution should be inferred from the reported asset movements or the competing technical interpretations.
What to watch
Binance’s further technical disclosures are the central open question. The exchange said, through the account reported by CoinDesk, that its preliminary investigation found no evidence of a private key leak. Security researchers’ interpretation of signed transactions across nine other chains leaves open how the hot wallet signing process was controlled.
Further attention will also center on how much of the reported $6.3 billion impact remains frozen, recoverable or mobile, and whether the reported stablecoin freezes affect the attacker’s ability to continue converting assets. Binance’s updates on customer coverage, the role of SAFU and company funds, and any final assessment of attribution will provide additional clarity.
For now, the reported conversion of seven tokens into 70,480 ETH provides a visible record of one part of the incident, but not a complete explanation of the breach or its eventual financial outcome.
