Binance said its preliminary investigation suggests an attacker may have compromised an engineer’s laptop, accessed an internal system, and submitted unauthorised withdrawal transactions.

The company found no evidence that wallet private keys had been leaked.

Binance said it would cover all losses through its Secure Asset Fund for Users (SAFU) and company funds. It maintained that customer assets remained safe.

Binance worked with blockchain companies, including Tether and Circle, to freeze cryptocurrency linked to the breach.

Tether froze nearly $1.57 billion, while Circle blocked more than $800 million. Ripple and other companies also helped restrict transfers of affected assets.