Binance Issues Security Incident Progress Update #2: Hot Wallet Attack Caused About $6.3 Billion in Losses, Pledges Full Compensation
On October 30, 2026, Binance released Security Incident Update #2, disclosing progress over the past 24 hours in its investigation and asset compensation. The announcement said that at around 20:05 (UTC) on October 29, 2026, the company’s hot wallet suffered unauthorized withdrawals, resulting in losses of about $6.3 billion in token assets. Binance stated clearly that it will cover the losses in full through the SAFU fund and the company’s own funds, and that user funds are not affected.
The announcement said the company has prepared more than $6.34 billion in company funds, with more than $5 billion equivalent in USDC, USDT, BTC, ETH, BNB and other stolen tokens already in place. About 80% of the stolen funds have been replenished, and the remaining portion is being purchased through market and over-the-counter channels. Earlier, the company worked with blockchain partners to freeze about $3 billion in assets on-chain. Regarding the attack path, the initial investigation pointed to a compromised DevOps engineer’s laptop that could access service containers and submit unauthorized withdrawals; later findings showed that other intrusion points also existed. No evidence of wallet private key leakage has been found so far, and further technical investigation results are expected to be released within about 48 hours.
As for subsequent arrangements, the technical team aims to gradually restore withdrawal services in stages within about 34 hours, subject to the progress of security checks; the first proof-of-reserves snapshot is planned within 12 hours, and the results are scheduled to be announced by November 2. The company will continue working with law enforcement agencies, blockchain intelligence companies and asset issuers to track and recover the funds, and will publish a full technical postmortem. Source: public information.
Original sources:
Title: Security Incident Update #2 (2026-10-30)
Publisher: Binance
Publication date: 2026-10-30
URL: https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751
Source type: official company announcement
Verification status: original text read
Supported content: attack time, about $6.3 billion loss, full coverage by SAFU + company funds, >$6.34 billion reserves (including >$5 billion matching tokens), about $3 billion frozen, no evidence of private key leakage, 34-hour withdrawal target, proof-of-reserves timetable, further investigation timelineTitle: Security Incident Update (2026-10-30)
Publisher: Binance
Publication date: 2026-10-30
URL: https://www.binance.info/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
Source type: official company announcement
Verification status: checked
Supported content: initial laptop intrusion path, no private key leakage, full coverage commitment
ABAB AI Insight
The core of Binance’s announcement is that it clearly quantified the loss scale (about $6.3 billion) and pledged to fully cover it with the SAFU fund and the company’s own funds, without passing it on to users. The company has set aside more than $6.34 billion in company funds, with more than $5 billion already held in the stolen tokens themselves, and the remaining roughly 20% is being replenished through market purchases and over-the-counter purchases. This is different from a simple “promise to cover”; it is a reserve arrangement in the form of matching assets, and the company plans to take a proof-of-reserves snapshot within 12 hours and announce the results by November 2, providing verifiable evidence of sufficient funds.
As for the attack path, the announcement expands the initial conclusion from “a single compromised laptop” to “other intrusion points also existed,” while making clear that no evidence of wallet private key leakage has been found so far. This means the unauthorized withdrawals were more likely achieved through operational infrastructure, such as access to service containers, rather than by directly stealing private keys. About $3 billion has already been frozen on-chain, showing that cooperation with issuers and intelligence companies has had some effect, but the remaining funds still need to be tracked continuously. Withdrawal restoration has been set to be rolled out in stages within about 34 hours and is subject to security checks, indicating that the priority is to complete infrastructure rebuilding and testing first rather than opening immediately.
For an exchange, large-scale unauthorized withdrawals from hot wallets expose issues in signature/withdrawal system permission management and operational security. The full coverage commitment depends on the company’s own funds and SAFU’s actual payment capacity, as well as the transparency of subsequent proof-of-reserves. The publicly available information currently confirms the loss amount, coverage method, frozen amount and recovery timetable, but the full attack chain, responsibility attribution and final recovery ratio still await the follow-up technical postmortem. Whether user funds are ultimately fully unaffected will depend on the speed at which the coverage funds arrive and the system’s stability after withdrawal resumes.
ABAB News · Cognition Law
A full coverage commitment must be paired with matching token reserves and a proof-of-reserves timetable to constitute a verifiable repayment arrangement.
The change in wording from “single-point laptop” to “multi-point intrusion” shows that the attack path is still under investigation and has not yet been fully determined.
The about $3 billion on-chain freeze and the purchase of the remaining funds run in parallel, indicating that compensation and recovery are two separate paths.