The hack happened to Binance’s global centralised exchange, Binance.com.
Binance.us, which provides trading services specifically for US residents, said it has not been affected by the issue.
In a statement, Teng said: “Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop.
“That gave an attacker access to a service container, where they submitted unauthorised withdrawal transactions.”
He said the hack “was not a simple ‘one-click’ action” but a “more complex attack process”.
Raghu Nandakumara, vice president of industry strategy at cybersecurity platform Illumio, said this could mean an engineer was “talked into taking a test” and malware – malicious software – “landed on their laptop while they did it”.
Because the laptop already had sufficient security privileges, Nandakumara said early reports suggest it became “the attacker’s route straight into production, and from there to the wallets”.
“You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened,” said Dr Clive Summerfield, head of FARx, a biometrics in AI security company.