The short version
- Binance hack update: Binance is working with the FBI and the US Secret Service, Reuters reported, and the exchange says it found more breach points than one compromised laptop.
- TRM Labs ties the $6.3 billion theft to North Korea’s TraderTraitor, the unit the FBI named for the $1.5 billion Bybit hack in 2025, while co-CEO Richard Teng says no single engineer is to blame.
- CZ asked Elon Musk to stop trolling and put Binance’s uncovered gap at about $2 billion; the crew is watching for an FBI notice and the withdrawal restart around 06:00 UTC Sunday.
This Binance hack update starts with a bigger cast. A day after the $6.3 billion theft, the case has moved from one compromised laptop to federal investigators, and Binance co-founder Changpeng Zhao spent Friday morning asking Elon Musk to stop laughing about it.
Binance is working with the FBI and the US Secret Service on the investigation, Reuters reported on Friday, citing sources. Binance itself only says it is working “in coordination with law enforcement.” We covered how the theft happened and what was frozen in our Binance hack report.
Binance’s Friday update is the one that changed the story:
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
This was a complex attack, and we are doing all we can in coordination
Binance Hack Update: More Than One Laptop
Binance found more ways in. Binance said on Thursday night that the attack may have started with a DevOps engineer’s laptop. On Friday it said the investigation “has uncovered additional points of breach” and called it “a complex attack.”
Co-CEO Richard Teng went further. The attacker “did not simply use one engineer’s permissions,” he wrote, and it “was not a single ‘one-click’ action.” He also said the investigation “has not attributed responsibility to any individual,” which reads as a clear signal that Binance isn’t pinning this on one employee.
That matters more than it sounds. One stolen laptop is one mistake. Several breach points into the system that sends withdrawals is a deeper problem, and it explains why Binance is rebuilding that service before it reopens. Binance still says it has found no evidence that any wallet private key leaked.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Why Are the FBI and Secret Service Involved?
Neither agency has commented on the Binance FBI investigation, but the suspect explains a lot. Blockchain analytics firm TRM Labs ties the theft to TraderTraitor, North Korea’s state hacking unit, “with high confidence.”
The FBI knows that unit well. It named TraderTraitor as the group behind the $1.5 billion Bybit hack in February 2025, five days after the theft, and published the hacker’s addresses so exchanges could block them. The Secret Service handles financial crimes and has chased stolen crypto before. Tether and Circle already froze their share of the loot in coordination with law enforcement.
A public FBI notice would be the next step to watch. It turns the hacker’s wallets into a list every exchange and bridge can refuse.
SIDE TRAIL: Binance Withdrawals Back Within 48 Hours: What Users Should Do Now
CZ Tells Elon Musk to Stop Trolling
Musk got in early. At 22:33 UTC on Thursday, as the first outflows hit the news, he quote-posted a report of the hack with three words: “Everyday is Zeroday.” A zero-day is a flaw attackers use before anyone has a fix. The post passed 5 million views.
He kept going on Friday with a “😬” in the replies to CZ’s promise to cover the loss, and a “🔥😂” under a post CZ wrote on Wednesday, a day before the hack: “Do NOT click links in emails.”
CZ answered at 09:19 UTC:
@elonmusk @HuaweiMate6 Elon, have a lot of respect for you, but bad time to troll. Please stop.
Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion.
Would appreciate if you show a little support. Thanks!
He wasn’t only asking for manners. Binance put $500 million into Musk’s Twitter takeover in 2022, and CZ says that stake now sits in SpaceX shares worth more than $1 billion. He then did the sums in public: a hack of $6 billion and change, $3 billion frozen and a SAFU fund of over $1 billion leave a gap of about $2 billion, which he called “still painful, but” manageable.
CZ later said he wasn’t talking about selling the SpaceX shares. Co-CEO Yi He added that this year’s revenue alone is enough to cover the losses.
Bitcoin and BNB Price on Day Two
Bitcoin trades at $77,700 at the time of writing, down 3% in 24 hours, with the $76,250 swing low as the line to hold. BNB is down 5% at $702, under its 50-day moving average at $750, with $675 as the next support.
The crew is watching three things: whether the FBI goes public with the hacker’s addresses as it did for Bybit, whether withdrawals restart around 06:00 UTC on Sunday as planned, and what the post-mortem says about those extra breach points.
TRAIL MAP: Protecting Your Crypto Accounts: 2FA, Passwords and Phishing
In crypto since 2017, trading stocks for over 20 years. MBA. Follows the economic data and US markets closely.
More from Satoshi Flipper →
