Binance Exchange says it has been hacked US$40 million worth of Bitcoin

One of the world’s largest cryptocurrency exchanges, Binance said on Wednesday hackers withdrew 7,000 Bitcoin totalling around US$40 million in a single transaction, in a ‘large scale security breach’, and the crypto exchange said it will use its emergency fund to cover for the incident in full.

The security breach was discovered at 5.15pm UTC time on May 7, 2019, and Binance said the hackers were able to obtain a large number of user information including application programming interface keys and two-step factor authentication codes.

The hackers had used a variety of techniques to hack into the exchange, including phishing, viruses and other attacks.

Binance said in a statement it is ‘still concluding all possible methods (of hacking) used. There may also be additional affected accounts that have not been identified yet.’

The transaction had impacted the exchange’s Bitcoin hot wallet, which contained around 2% of its total Bitcoin holdings. The firm added that its other wallets are secure and unharmed.

‘The hackers had the patience to wait and execute well-orchestrated actions through multiple seemingly independent accounts at the most opportune time. The transaction is structured in a way that passed our existing security checks,’ said Binance’s chief executive Zhao Changpeng, in a written post.

‘It was unfortunate that we were not able to block this withdrawal before it was executed. Once executed, the withdrawal triggered various alarms in our system. We stopped all withdrawals immediately after that,’ he said.

The firm will be using its secure asset fund for users (SAFU) to cover for the hack. The fund is an emergency insurance fund the exchange had set up on July 3, 2018, to protect its users.

The firm allocates 10% of all trading fees received into SAFU to protect its users and their funds ‘in extreme cases’. This fund is stored in a separate cold wallet.

The firm will be conducting a security review which will take around a week to update its customers on the incident and has currently suspended deposits and withdrawals.

Binance said trading on the exchange, meanwhile, is still allowed and it will continue to monitor the situation.

Bitcoin was little changed hours after the announcement from Binance, as it edged lower by US$34.14 or 0.6% to US$5,828.24, according to IG data.