Binance: Preliminary review suggests the incident may involve a DevOps engineer’s computer being compromised, estimated impact of about $6.3 billion
On October 30, Binance posted a security incident update on X saying that the preliminary review shows the incident may involve a DevOps engineer’s laptop being compromised, allowing the attacker to enter service containers and submit unauthorized withdrawal transactions. No evidence of any wallet private key leak has been found so far.
Binance said the estimated total impact is about $6.3 billion, and that it has frozen related assets with blockchain partners, with about $3 billion frozen on-chain. The company will cover all losses with the SAFU fund and company funds, and user funds are safe. After the repairs are completed, it will announce an updated proof of reserves.
As an immediate measure, Binance has temporarily suspended deposits and withdrawals to complete security checks, revoked authorization for the affected addresses, and is working with law enforcement and blockchain intelligence partners to track and recover the funds. A full technical postmortem will be released after the investigation ends and the facts are verified.
Original source:
Title: Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop... Publisher: Binance (@binance) Publication date: 2026-10-30 URL: https://x.com/binance/status/2115993361517891592 Source nature: official announcement Verification status: full text actually read this time, verified on 2026-10-30 Supported content: all core statements including the preliminary investigation path, no private key leak, estimated impact of about $6.3 billion, about $3 billion frozen, covering the loss with SAFU and company funds, user fund safety, suspension of deposits and withdrawals, revoking authorization, cooperation with law enforcement and intelligence partners, subsequent technical postmortem, and obtaining information only through official channels
ABAB AI Insight
This update from Binance describes the incident path as unauthorized withdrawals submitted after entering service containers through a compromised engineer terminal, rather than direct theft of wallet private keys. This differs from the pattern in some previous exchange incidents involving “private key leaks” or “direct control of hot wallets,” and emphasizes misuse of internal system access privileges. The company also gave specific numbers: an estimated total impact of about $6.3 billion and about $3 billion already frozen, and clearly stated that SAFU funds plus company funds will fully cover the losses, which is its public commitment to user fund responsibility at an early stage of the incident.
SAFU (Secure Asset Fund for Users) is Binance’s previously established fund to protect user assets. This time, by explicitly listing it alongside company funds for coverage, Binance means that even if the frozen amount does not cover the entire estimated loss, the remainder will be borne by the company. Suspending deposits and withdrawals, revoking authorization for affected addresses, and cooperating with law enforcement and blockchain intelligence partners are standard emergency measures aimed at preventing further outflows and increasing the chance of recovery.
Compared with Bybit’s approximately $1.5 billion incident in 2025, the estimated scale this time is larger, but the official path description focuses on a single-point terminal intrusion rather than a broader failure of key management. There is currently no public independent third-party verification of the $6.3 billion figure or the specific intrusion details, and the full technical postmortem has not yet been released. Points to watch are whether the subsequent official postmortem confirms this path, the actual net loss amount, further recovery progress on frozen assets, and when the updated proof of reserves will be published.
ABAB News · Law of Cognition
An official “preliminary review” path is not the same as the finally confirmed full technical facts.
The gap between the amount already frozen and the estimated total impact needs to be filled by company funds or later recoveries.
The statement that user funds are “safe,” together with the suspension of deposits and withdrawals and the promise of full coverage, reflects responsibility allocation rather than the disappearance of the incident’s scale.