Binance said its initial investigation suggests that the hack that began on October 29, with an estimated total impact of around $6.3 billion, may have involved "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." The exchange said it had found no evidence of any wallet private key leak, and that about $3 billion had been frozen on-chain.
About six hours later, Binance widened that account: its initial investigation "suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach." The company called it "a complex attack," said it would cover all losses from its SAFU fund and its own funds, and said it would share more as it gathered the facts. The $6.3 billion is 4.2 times the roughly $1.5 billion that the FBI says North Korea stole from Bybit in February 2025.
Sources: Binance's posts on X, October 30; FBI alert I-022625-PSA. Ratio calculated by SaasBuzz.
What Binance has said, hour by hour
Every time below is UTC. The first two entries come from the security company Blockaid; the rest are Binance's own posts on X.
October 29, 8:24 p.m. Large outflows from Binance hot wallets begin, according to Blockaid, which saw them on Ethereum, Arbitrum and Avalanche.
9:11 p.m. Blockaid flags the outflows publicly and says Binance has not confirmed them.
9:16 p.m. Binance says it is aware of reports of a potential security issue, 53 minutes after the first outflows.
11:22 p.m. Binance puts the verified frozen total at $2.54 billion.
October 30, 12:13 a.m. Binance says it will cover all losses and suspends deposits and withdrawals.
2:25 a.m. The DevOps laptop and service container finding, the $6.3 billion estimate and about $3 billion frozen.
4:36 a.m. Deposits are operating normally. Withdrawals stay paused for "a security revamp of the withdrawal service and its related addresses," expected within 48 hours.
8:47 a.m. "Additional points of breach." Withdrawals still expected to resume in 45 hours, which would be around 5:47 a.m. UTC on November 1.
What the industry is saying
Richard Teng, Binance's co-CEO, wrote on X at 7:37 a.m. UTC on October 30 that the attack went beyond one person's access, and that the company has not blamed the engineer.
To be clear: the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.Richard Teng, co-CEO of Binance, on X, October 30, 2026
On-chain analysts were reading the attack from the blockchain hours before Binance gave its account. Blockaid, a blockchain security company, wrote that the attacker had to guess the live nonce, a transaction counter, of a busy Binance hot wallet labeled Binance 14.
So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx. Only 1 of 50 was a hit.Blockaid, on X, October 29, 2026
The stablecoin issuers moved within the first hour. Jeremy Allaire of Circle said at 9:18 p.m. UTC on October 29 that Circle had frozen more than 800 million USDC in coordination with law enforcement. Binance founder Changpeng Zhao, who wrote that he no longer manages the exchange, thanked Tether and Circle for the freezes.
On who did it, Binance has named no one. The on-chain investigator ZachXBT reported that stolen funds were mixed at one address with funds from a separate $388 million exploit at another exchange, Bitget, which he said had been attributed to a North Korea-linked group.
This indicates the same actor is likely behind both incidents.ZachXBT, on-chain investigator, on X, October 30, 2026
That is his reading of the on-chain trail, not a finding by Binance or by law enforcement.
What it means for engineering and security teams
By Binance's own account so far, there is no evidence that a wallet private key leaked. The company says a compromised engineer's laptop led to a service container that could submit withdrawal transactions, and that those transactions went through. The weak point in that description is the trust a signing system places in an internal service, and the reach of a developer's machine toward production. The account is preliminary, and Binance has since said there were more points of breach.
The pattern has a precedent. In the 2025 Bybit theft, Safe, the developer of the SafeWallet software at the center of that theft, found with the incident responder Mandiant that attackers compromised a Safe developer's macOS system and used the developer's live AWS session tokens to get around multifactor authentication, Cointelegraph reported.
The OWASP Top 10 CI/CD Security Risks name the controls at stake. Its entry on credential hygiene says "Prefer using temporary credentials over static credentials," and its entry on identity and access management calls for least privilege "for both application and human accounts," with permissions that expire. For teams reading this incident, three questions follow from Binance's description:
Which internal services can ask a signing or payment system to move money, and does that system check anything beyond the caller's identity?
Can a developer's laptop reach production containers, and with what credentials?
How long do those credentials live, and would anyone notice a burst of unusual requests?
Binance's own first steps point the same way. It said it revoked "the affected address authorisation" and is revamping the withdrawal service and its related addresses before reopening withdrawals. The post-mortem it has promised should show whether the laptop was the entry point or one of several, and what the service container was allowed to do.
