Binance says an October 29 security incident affected approximately $6.3 billion in crypto assets, after an attacker apparently gained access to systems able to authorize withdrawals. The exchange has suspended deposits and withdrawals while it checks the affected infrastructure.
The preliminary cause is not a publicly confirmed theft of wallet private keys. In an October 30 notice, Binance said it suspects a DevOps engineer’s laptop was compromised, allowing access to a service container and the submission of unauthorized withdrawal transactions. The company emphasized that this explanation remains under investigation.
The Entry Point Matters More Than the Laptop
An exchange can keep its private keys encrypted and still be vulnerable if the systems permitted to request signatures are taken over. A service container sits in the operational layer between an application and the infrastructure carrying out its instructions. If an attacker can send unauthorized withdrawal requests through an already trusted path, the resulting blockchain transfers may appear properly signed.
That distinction explains the wording of Binance’s update. It reported no evidence of any wallet private-key leak, but the absence of a known key leak does not establish that the transaction-approval environment remained secure. Binance has not published a final technical post-mortem, so the precise access path and control failures are not settled.
The Outflows Crossed Multiple Chains
Blockchain intelligence company TRM Labs separately traced approximately $6.36 billion in transfers from Binance-attributed wallets to attacker-controlled addresses on ten chains. According to TRM, most of the movement occurred in roughly twenty minutes starting at 20:05 UTC on October 29.
The chains included Ethereum, Bitcoin, Tron, the XRP Ledger and Solana, as well as several Ethereum-compatible networks. That breadth is one reason investigators are examining the common operational systems behind withdrawal authorization rather than treating this as an isolated bug in one blockchain.
Funds Frozen, But the Investigation Is Not Over
Binance said about $3 billion of affected assets had been frozen on-chain by the time of its October 30 announcement. It has revoked affected address authorization, engaged investigators and law enforcement, and promised to cover all losses through its SAFU reserve and company funds. It also said it would publish updated proof of reserves after remediation.
Those assurances address the exchange’s planned financial response. They are not a substitute for a final accounting of every compromised asset or a technical explanation of how access was obtained. The freeze amount may change as investigators trace further funds.
For customers, the immediate verified service change is the deposit-and-withdrawal suspension, not a finding that individual customer accounts or passwords were compromised. Binance advised users to rely on official channels and be wary of impersonation scams during the incident.
Sources
1. Binance, Security Incident Update, October 30, 2026
