The company's co-CEO Richard Teng says initial investigations suggest a "compromised DevOps engineer's laptop" gave hackers access - but adds the "complex attack" was not a "single 'one-click' action"
Teng also tells customers their "money is safe, and we're covering every loss" - read his statement in full
Two analytics firms have attributed the incident to a North Korean hacking unit, though no one has claimed responsibility
In the last five years the crypto industry has been beset by enormous losses from hackers, with investigators almost always blaming hackers from North Korea, writes our cyber correspondent
Blockchain intelligence firm TRM Labs says several elements of the Binance attack resemble earlier North Korean-linked incidents, including last year's $1.5bn Bybit hack
In the last five years the crypto industry has been beset by enormous losses from hackers.
Each year seems to see a more devastating hack, with crypto exchanges often the target.
In nearly all cases investigators have blamed hackers from North Korea, pointing to the infamous Lazarus Group - also know as TraderTraitor. The names refer to clusters of cyber criminals accused of working directly for the regime.
North Korea is an impoverished country with very little industry and heavy international sanctions and experts say the regime uses cyber crime as a way to bring money in.
North Korea has always denied this, but the wealth of evidence from cryptocurrency flow analysis and insider interviews from defectors is compelling. It makes North Korea likely to be the only nation that uses hacking as a way to raise public funds.
This is thought to be the largest crypto hack on record, but the reason it stands out is because of how it was carried out, according to expert Jayant Dave from cyber security firm Check Point.
"The attackers didn't break the encryption or steal the private keys. They took over the system that tells the keys what to sign," he says.
He says Binance's early findings point to one compromised engineer's laptop, with attackers using it to reach a service that could submit withdrawals, moving billions "within minutes".
"That's the lesson: a strong vault doesn't matter if someone controls the process that opens it," Dave says.
He says it's not just crypto companies that are exposed to this risk. He says that banks or other institutions with automated systems that move money or data on instruction face the same risk.