Key Takeaways:
- Binance estimates that it lost about $6.3 billion in the security incident.
- About $3 billion is already frozen on-chain.
- According to Binance, the private keys for its wallet were not leaked.
Binance has released its clearest update yet on the security incident that shook crypto markets this week, putting the estimated total impact at around $6.3 billion.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.As an immediate precaution, Binance has:
– temporarily suspended deposits and withdrawals while security checks are completed;
– revoked the affected address authorisation;
– engaged law enforcement and blockchain intelligence partners to trace and recover funds.Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
https://t.co/ywB2mKFy0p
— Binance (@binance) October 30, 2026
It says its preliminary probe yielded no sign of a compromise of its wallet private keys, and that recovery processes have already halted the flow of nearly half the impacted funds.
Read More: Binance Wallet Opens $4.7T Pre-IPO Market Access Through PancakeSwap Tokenized Deals
Binance Traces Breach to Compromised DevOps Laptop
Binance said that the attack might have begun by exploiting an attacker’s laptop belonging to one of the company’s DevOps engineers. That access, allegedly, enabled the attacker to access a service container to make unauthorized withdrawals.
An important finding, Binance emphasized that they have not seen any evidence of a private-key compromise, which can generate a much bigger security issue.
It is stating that, pending a complete investigation and facts, it will release a full technical follow-on report.
$3 Billion in Crypto Already Frozen
The total losses caused by the incident are now estimated to be about $6.3 billion by Binance. That includes approximately $3 billion that’s been on-chain with the help of blockchain partners.
This is not to say that $3 billion has already been recovered, never mind returned. Frozen accounts are money that has been held in place by investigators in hopes they can follow the money.
The revised $6.3 billion is an estimate of the overall impact of the incident, and does not necessarily equal the amount of money that will actually be recovered.
Read More: Binance’s CZ Drops ‘Freedom of Money’ Book Next Week
Binance Says SAFU and Company Funds Will Cover Losses
Binance claims it will not have any financial consequence for customers. The exchange will write down losses from the SAFU fund and company funds, but will state that user assets are safe. There will also be an updated Proof of Reserves published upon completion of the remediation work.
Here is Binance’s initial containment actions which included halting deposits and withdrawals. It also took away the address authorisation and introduced police and blockchain intelligence companies to assist with tracking the money and determining who was behind it.
Withdrawals Remain Under Security Review
The exchange hasn’t yet announced the final date by which the deposits and withdrawals will return to normal. Binance’s temporary ban will be in effect until these security questions have been completed, and a technical investigation is the next crucial factor to track, the company said.
The firm is also collaborating with police to determine who is behind the attacks and seek to recover other lost assets.
Binance has advised its users to solely connect with official communications channels in the meantime, while the investigation proceeds. The complete technical report should include more specific detail of how the attacker got to the service container, how the unauthorized withdrawals on the service container were approved, and whether further internal controls will be affected by the breach or not.
