Binance says security breach affected $6.3 billion in crypto

Binance says an attacker used a compromised DevOps engineer’s laptop to reach a service container and submit unauthorized withdrawal transactions, affecting about $6.3 billion in crypto assets. The exchange says it will cover losses and has begun restoring withdrawals in phases. In its Oct. 30 security incident update, Binance said its initial investigation pointed to the laptop as a possible entry point, while the full attack path remained under investigation.

How did the attacker reach the withdrawal process?

Binance’s initial account describes a chain of access. First, the attacker may have gained access through the engineer’s laptop. From there, the attacker reached a service container, then used it to submit withdrawal transactions that Binance had not authorized. A service container is a software environment used to run an application or service. Think of it as an internal workroom connected to the withdrawal system: access to the room could let someone send instructions, without necessarily exposing the keys that secure the wallets.

Binance said it had found no evidence that wallet private keys were leaked. It revoked authorization for the affected address and worked with blockchain partners to freeze assets. The company estimated the total impact at about $6.3 billion, with roughly $3 billion frozen on-chain at the time of its update. The estimate describes the assets affected by the incident; the frozen amount is the portion partners had stopped from moving.

What can customers do while checks continue?

Binance temporarily suspended withdrawals while it completed security checks. Deposits remained open, according to its update. The exchange said it would publish a technical post-mortem after verifying the facts, and cover losses from its SAFU fund and company resources. SAFU is Binance’s fund for protecting users in emergencies.

On Nov. 3, Binance said it would reopen withdrawals for more assets, in stages as security and readiness checks were completed. Some withdrawal routes may therefore remain unavailable while others resume. The company said it would bear the financial impact of the stolen funds and that losses would not be passed to users.

What is confirmed about the breach?

The Associated Press report on Binance’s investigation said the exchange had not initially confirmed the extent of any theft. Binance’s later updates refer to stolen assets, but its initial account did not establish the full technical path. The company said a detailed report would follow once its investigation was complete. Until then, the laptop-to-container route remains Binance’s preliminary explanation, not a completed forensic account.

Source material

• Oct. 30 security incident update — binance.com
• Associated Press report on Binance’s investigation — apnews.com