Binance co-CEO Richard Teng and the exchange’s official account said this morning that the October 29 outflows may have started with a compromised DevOps engineer’s laptop. The laptop gave an attacker access to a service container from which unauthorized withdrawal transactions were submitted. Binance has put the estimated total impact at roughly $6.3 billion, with about $3 billion frozen on-chain so far.
Teng wrote that the attacker “did not simply use one engineer’s permissions” and that the incident “was not a single ‘one-click’ action.” He described it as a more complex attack process. The exchange said it has found no evidence of any wallet private key leak and that its investigation has not attributed responsibility to any individual. Binance later clarified that its initial findings pointed to a compromised laptop, but subsequent investigation has uncovered additional points of breach.
What Binance has confirmed so far
- Estimated total impact: ~$6.3 billion.
- Approximately $3 billion frozen on-chain in coordination with blockchain partners.
- No evidence of a wallet private key leak.
- Withdrawals remain suspended while the exchange completes a security review of the withdrawal service and related addresses. It expects to resume withdrawals in roughly 45 hours. Deposits are unaffected.
- All losses will be covered from the SAFU fund and company funds. User funds are safe.
How this fits the earlier on-chain picture
On-chain analysis published yesterday showed the Binance 14 hot wallet signing an EIP-7702 delegation that pointed it at attacker-controlled code, after which a single transaction swept ETH and dozens of tokens. Security researchers had already described the activity as pointing to compromise or misuse of the signing infrastructure rather than a simple private-key theft. A laptop that granted access to the internal service that can request signatures is consistent with that earlier reading: valid signatures could be obtained without the attacker ever holding the private key itself.
Binance has not yet released a full technical post-mortem. It said it will do so once the investigation is complete and every fact is verified, and that it will publish an updated Proof of Reserves once remediation is finished.
What remains open
Whether a single compromised laptop was the sole entry point, or one of several, is still being examined. How the laptop was compromised, what privileges the DevOps role held, and which additional controls failed have not been disclosed. No public attribution has been made by Binance. External blockchain intelligence firms have linked the activity to North Korea’s TraderTraitor cluster with high confidence; Binance has not confirmed or denied that assessment.
The $6.3 billion figure is Binance’s own estimate of total impact. The final verified loss, after freezes and any recoveries, has not been stated. Whether the exchange’s withdrawal service and signing infrastructure can be restored without further disruption, and whether the updated Proof of Reserves will show full backing once remediation is complete, will be clearer once those steps are finished.
Author: Andy Samu
See Also:
Binance Hot Wallets Lose $3.5bn in Potential Record Crypto Hack | Disruption Banking
Andrew Samu
Andrew Samu, Editor-at-Large at Disruption Banking, shapes the publication’s global coverage of banking, capital markets and digital assets. Based at London’s Level39, he combines market analysis with a strong commercial perspective, informed in part by his role as Commercial Director at Verita HR.
