Safe

<p><img width="1200" height="844" src="https://financefeeds.com/wp-content/uploads/2026/10/binance-hack-6-3-billion-devops-laptop.jpg" alt="Official Binance statement on X attributing the hack to a compromised DevOps engineer laptop with a 6.3 billion dollar impact" title="Binance Hack Hits $6.3B, Traced to a Hacked DevOps Engineer's Laptop 8"></p>
<p><strong>Update:</strong> Binance Withdrawals to Resume Within 48 Hours, Deposits Back to Normal. <a href="https://financefeeds.com/binance-withdrawals-resume-48-hours/" rel="noopener noreferrer nofollow">Read the latest on the Binance hack</a>.</p>
<p>Binance has put a number and a cause on the Binance hack: about $6.3 billion, traced to a single compromised laptop. In an <a href="https://x.com/binance/status/2115993361517891592" rel="noopener noreferrer nofollow">official statement on X</a> at 02:25 UTC on 30 October, the exchange said its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop." The laptop "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." At $6.3 billion, it would be the largest crypto theft on record, more than four times the $1.5 billion taken from Bybit in February 2025.</p>
<p>Binance also confirmed for the first time how it will pay: "Binance will cover all losses from the SAFU fund and the company's funds."</p>
<h2 id="what-binance-disclosed">What Binance Disclosed</h2>
<p>The statement gives the first official loss figure since the drain began at 20:24 UTC on 29 October: "The estimated total impact sits at around $6.3B." Of that, "~$3 billion" is "frozen on-chain so far." Binance said it has found "no evidence of any wallet private key leak," has "revoked the affected address authorisation," and will publish "an updated Proof of Reserves once the remediation is complete." Deposits and withdrawals stay suspended, and a "detailed technical post-mortem" will follow.</p>
<p>The statement, which links to a <a href="https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7" rel="noopener noreferrer nofollow">Binance support announcement</a>, adds that Binance is "working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice." It is the first time the exchange has described the attackers as criminals, after hours of calling the incident only a "potential security issue."</p>
<h2 id="no-key-leak-but-keys-weren-t-needed">No Key Leak, but Keys Weren't Needed</h2>
<p>The "no private key leak" line fits the on-chain evidence better than it first appears. <a href="https://financefeeds.com/binance-hack-3-3b-hot-wallets-drained-tether-circle-freeze/" rel="noopener noreferrer nofollow">FinanceFeeds' first report</a> showed that a Tornado Cash-funded address switched a Binance hot wallet to run its own contract through an EIP-7702 delegation, which requires a valid signature from the wallet. If the attacker controlled a service container that is allowed to request signatures, they could get valid signatures without ever seeing the key. They did not need to steal the key, only to reach the machine that uses it.</p>
<p>That is the same pattern as the Bybit breach, where attackers compromised a developer machine at wallet provider Safe and used it to push a malicious transaction that Bybit's signers approved. The two largest exchange thefts on record now both trace back to one engineer's computer rather than to broken cryptography. For brokers and custodians, that shifts the audit question from how keys are stored to who and what can ask for a signature.</p>
<h2 id="the-3-3-billion-gap">The $3.3 Billion Gap</h2>
<p>With $6.3 billion lost and about $3 billion frozen, roughly $3.3 billion is still outside Binance's reach. The <a href="https://financefeeds.com/binances-safu-fund/" rel="noopener noreferrer nofollow">SAFU fund</a>, which Binance <a href="https://financefeeds.com/binance-finalizes-1b-bitcoin-transfer-to-safu/" rel="noopener noreferrer nofollow">filled with $1 billion in Bitcoin</a> earlier this year, covers less than a third of that. The rest, at least $2.3 billion before any further recoveries, would come from Binance's corporate balance sheet. That explains why the statement names "the company's funds" alongside SAFU, extending the <a href="https://financefeeds.com/binance-will-cover-all-losses-hack/" rel="noopener noreferrer nofollow">"cover all losses" pledge</a> Binance made at 00:13 UTC.</p>
<p>The new figure also puts the freeze in context. When Binance reported <a href="https://financefeeds.com/binance-hack-3-billion-frozen/" rel="noopener noreferrer nofollow">about $3 billion frozen</a>, that looked like most of the loss on the $3.3 billion Ethereum estimate. Against $6.3 billion, it is under half. The rest is mainly Bitcoin and ETH, which issuers cannot freeze.</p>
<h2 id="market-reaction-and-what-comes-next">Market Reaction and What Comes Next</h2>
<p>The market took the disclosure as clarity rather than shock. BNB rose to $712.88 at 02:34 UTC, trimming its 24-hour loss to 4.4% from more than 8% earlier in the night, according to <a href="https://www.coingecko.com/en/coins/bnb" rel="noopener noreferrer nofollow">CoinGecko</a>. Bitcoin traded at $77,183.</p>
<p>Three things will decide whether that holds: the updated Proof of Reserves, a reopening date for <a href="https://financefeeds.com/binance-halts-withdrawals-suspected-hack/" rel="noopener noreferrer nofollow">withdrawals suspended since 22:15 UTC</a>, and the post-mortem's account of how one laptop reached a signing service. Binance's first statement on the incident was <a href="https://financefeeds.com/binance-hack-statement-edited-user-funds-safe/" rel="noopener noreferrer nofollow">edited twice in 13 minutes</a>. Tonight's disclosure is the first to give a loss figure, a cause and a funding source. No government agency or regulator has commented publicly. FinanceFeeds will update this coverage as official information arrives.</p>

Binance Hack Hits $6.3B, Traced to a Hacked DevOps…

Table of Contents

FinanceFeeds

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!