Binance has confirmed a security breach on its crypto exchange and estimated the total impact of a security incident at around $6.3 billion. It said an initial investigation points to a compromised DevOps engineer’s laptop.
According to the exchange, the laptop gave an attacker access to a service container, which was used to submit unauthorised withdrawal transactions. Binance said it has “found no evidence of any wallet private key leak” and will publish a detailed technical post-mortem once the facts are verified.
London’s trading industry is coming home!
What Binance Says It Has Done
The exchange said it worked with blockchain partners to freeze affected assets, with roughly $3 billion frozen on-chain so far. It will cover all losses from its SAFU fund and company funds, and says user funds are safe.
Binance has temporarily suspended deposits and withdrawals while security checks are completed, revoked the affected address authorisation, and engaged law enforcement and blockchain intelligence partners to trace and recover funds. It also plans to publish an updated Proof of Reserves once remediation is complete.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.As an immediate precaution, Binance has:
– temporarily suspended deposits and withdrawals while security checks are completed;
– revoked the affected address authorisation;
– engaged law enforcement and blockchain intelligence partners to trace and recover funds.Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
https://t.co/ywB2mKFy0p
— Binance (@binance) October 30, 2026
What the On-Chain Data Shows
Blockchain security firm Blockaid has published its own reading of the incident. It said the attacker took a single Ethereum type-4 transaction with 50 EIP-7702 authorizations aimed at a Binance hot wallet labelled Binance 14.
Under Ethereum’s EIP-7702, a signed authorisation lets a wallet hand control of itself to smart-contract code. Each authorisation is valid only for the current nonce at inclusion. Because the wallet was still sending transactions, the sender did not know which nonce would be live, so it submitted authorisations for 50 consecutive numbers at once. One matched.
That authorisation delegated the wallet to an unverified sweeper contract. Blockaid said only a designated operator can drain it, and that the operator address was funded through Tornado Cash. Minutes later the wallet was emptied of about $1.6 billion in USDT, 167,464 ETH and more than 60 other tokens.
Blockaid’s figure for the wider outflow differs from Binance’s. Across Ethereum, Bitcoin and Tron, the firm counted at least $5.57 billion leaving Binance-linked wallets.
The signatures were produced with the wallet’s own key, which only that key or the system holding it can do. How the attacker obtained them is not known.
‼️ UPDATE ON THE BINANCE HACK:
Whoever emptied a Binance hot wallet had 50 authorisations signed with that wallet’s own private key, on-chain data shows.
Under Ethereum’s EIP-7702, an authorisation is a signed permission that lets a wallet hand control of itself to code.
Each one works only for the wallet’s next transaction number, its nonce. Binance’s wallet was still sending transactions, so that number kept moving.
The sender didn’t know which number would be live, so they packed all 50 into one transaction, Blockaid says. One matched.
That one installed a sweeper contract on the wallet. Blockaid found that only the Tornado Cash-funded sender can operate it.
Minutes later it emptied the wallet of $1.6B in USDT, 167,464 ETH and 60+ other tokens.
Only that key, or the system that holds it, can produce those signatures. How the sender got them is unknown.
Across Ethereum, Bitcoin and Tron, at least $5.57B left Binance-linked wallets.
Binance says user funds are “completely safe” but has not explained how.
— International Cyber Digest (@IntCyberDigest) October 29, 2026
Blockaid CEO Ido Ben-Natan said it appears to be a compromise of signing infrastructure and that a key was not leaked. He described the pattern as “very, very similar” to the 2025 Bybit hack. Binance has not said how funds remain “completely safe”, the phrase cited in on-chain commentary, and has not confirmed how the transactions were authorised.
Billion Dollar Breaches
The Bybit breach in February 2025 is the incident most often compared with this one. FinanceMagnates.com reported at the time that hackers made off with $1.5 billion worth of Ether from the Bybit exchange. Blockaid describes the Binance event as the largest crypto theft on record.
Binance, meanwhile, in July, faced a £150M UK lawsuit from 1,692 retail derivatives traders. In June it began offering access to 7,000 US stocks alongside crypto. In February, CEO Richard Teng explained why Binance chose Greece for its EU MiCA licence.
Binance has not given a timeline for resuming deposits and withdrawals or for publishing the post-mortem.
This article was written by Arnab Shome at www.financemagnates.com.
Source link
