Binance Hacked: Withdrawals Frozen, Manipulation Warning, BTC Dropped
Major cryptocurrency exchange Binance said that hackers stole more than BTC 7,000 (USD 40 million) from them, as the company have discovered a large scale security breach on May 7, 17:15:24 (UTC).
The company estimates that deposits and withdrawals will be suspended for one week, but they "will continue to enable trading." In the past 24 hours, the trading volume on Binance stood at USD 1 billion.
"Please also understand that the hackers may still control certain user accounts and may use those to influence prices in the meantime. <...> But we believe with withdrawals disabled, there isn’t much incentive for hackers to influence markets," they added.
"We don't know exactly at what extent the number of users affected," Binance CEO Changpeng Zhao said during a livestream earlier today.
Bitcoin dropped following the announcement and is down by 1.67% in the past 24 hours. The rest of the market is also in red, mostly. Binance Coin, the native token of Binance, is down by 6,66% (04:11 UTC.) Later, the market somewhat recovered.
Bitcoin price chart:
Read more: What is the crypto community talking about the hack?
Binance claims that it will use the #SAFU fund (Secure Asset Fund for Users) to cover this incident in full and "no user funds will be affected."
Also, during the livestream, the CEO mentioned a possibility to roll back Bitcoin network transactions.
"To be honest, we can actually do this probably within the next a few days. But there are concerns that if we do a rollback on the Bitcoin network at that scale, it may have some negative consequences, in terms of destroying the credibility for Bitcoin,” he said, adding that "we will consider that very, very carefully, with the feedback we are receiving.”
According to recent discussions on Reddit, the crypto community is strongly against the rollback, as "any rollback is a horrible idea. This is the bitcoin version of a government bailout."
While we're at it, can we please undo the Bitfinex hack and MtGox as well?
— WhalePanda (@WhalePanda) May 8, 2019
Fuck it, let's just reset everything and start from 0.
Later, the CEO confirmed that they decided against the rollback, later adding that "to put this to bed, it's not possible, bitcoin ledger is the most immutable ledger on the planet. Done."
cons: 1 we may damage credibility of BTC, 2 we may cause a split in both the bitcoin network and community. Both of these damages seems to out-weight $40m revenge. 3 the hackers did demonstrate certain weak points in our design and user confusion, that was not obvious before.
— CZ Binance (@cz_binance) May 8, 2019
Read more: Could this rollback happen? And what would it truly mean?
Meanwhile, Binance explained that hackers were able to obtain a large number of user API keys, 2FA codes, and potentially other info.
"The hackers used a variety of techniques, including phishing, viruses and other attacks. We are still concluding all possible methods used. There may also be additional affected accounts that have not been identified yet," the exchange said.
According to the announcement, the breach impacted thei Bitcoin hot wallet only (which contained about 2% of their total BTC holdings.)
____Thanks for the support, really appreciate it. But currently no need. We will cover the loss from the #SAFU fund, there is enough. We are hurt, but not broke.
— CZ Binance (@cz_binance) May 8, 2019
We are working hard to resolve the issue, so that everyone can deposit and withdrawal again. Will take some time. https://t.co/0j4J0fk99W
Also thanks to @coinbase and many other exchanges (again, can't list everyone) pledging to block deposits from those addresses. Much appreciated!
— CZ Binance (@cz_binance) May 8, 2019
Also much appreciate the "unitedness" of our industry to fight hackers and fraud.
"The hackers had the patience to wait, and execute well-orchestrated actions through multiple seemingly independent accounts at the most opportune time. The transaction is structured in a way that passed our existing security checks. It was unfortunate that we were not able to block this withdrawal before it was executed. Once executed, the withdrawal triggered various alarms in our system. We stopped all withdrawals immediately after that," the exchange said, adding that the hackers were able to withdraw BTC 7,000 in this one transaction: https://www.blockchain.com/btc/tx/e8b406091959700dbffcff30a60b190133721e5c39e89bb5fe23c5a554ab05ea
The #Binance hacker just moved the funds again!
— Coinfirm (@Coinfirm_io) May 8, 2019
Coinfirm analysis shows 1227 #BTC of the #BinanceHack funds moved to 2 new addresses held by the hacker(Red bubbles)
One holds 707 BTC the other 520 BTC
Below is also a Coinfirm #aml Risk Report of one https://t.co/CdRIXAT8dC pic.twitter.com/c2VZwtfub6
Binance suspended deposits and withdrawals even before it announced the security breach, while their CEO claimed that "Funds are #safu."
Have to perform some unscheduled server maintenance that will impact deposits and withdrawals for a couple hours. No need to FUD. Funds are #safu.
— CZ Binance (@cz_binance) May 7, 2019
____
Trading volume on Binance:
___
As many experts have stressed previously, crypto users should keep their private keys to their coins offline, e.g. in hardware wallets such as Ledger, Trezor, KeepKey and others.
However, Changpeng Zhao earlier this year suggested that cryptocurrency users should store their private keys on an exchange.
