Binance Reports $6.3 Billion Security Incident

Binance, the world's largest cryptocurrency exchange by trading volume, is investigating a major security breach with an estimated financial impact of approximately $6.3 billion. The incident, disclosed on October 30, 2026, prompted the company to suspend deposits and withdrawals while it conducts security checks and works to contain the damage.

The exchange said its preliminary investigation identified a potentially compromised laptop belonging to a DevOps engineer as the possible entry point. According to the initial findings, an attacker may have used access obtained through the device to enter a service container and submit unauthorised withdrawal transactions.

Binance has not established the full circumstances of the incident. The company said it had found no evidence that cryptocurrency wallet private keys were compromised and promised to publish a detailed technical report after completing its investigation and verifying the findings.

Approximately $3 Billion in Assets Frozen

Binance has coordinated with blockchain partners and digital asset service providers to restrict the movement of funds associated with the incident. The company reported that approximately $3 billion worth of affected cryptocurrency had been frozen on-chain, representing nearly half of its estimated $6.3 billion exposure.

The freezing operation forms part of a broader effort to trace the affected transactions and recover assets. Binance has also revoked authorisation associated with the affected address and enlisted law enforcement agencies and blockchain intelligence specialists to investigate the movement of funds.

The exchange said recovery efforts remain ongoing. However, the final amount of recoverable assets and the precise financial consequences of the breach have yet to be established.

Exchange Suspends Deposits and Withdrawals

As an immediate precaution, Binance temporarily halted deposits and withdrawals across its platform. The suspension is intended to provide time for security checks and prevent further unauthorised transactions while the company addresses the vulnerability.

The exchange has also disabled the affected address authorisation and is working with external security specialists and law enforcement agencies. Its teams are continuing to investigate the breach, identify those responsible and pursue the recovery of the affected cryptocurrency.

The temporary restrictions have interrupted normal deposit and withdrawal activity for customers. Binance has not provided a definitive timetable for restoring the services, stating that security and remediation work must be completed first.

Binance Pledges to Cover All Customer Losses

In response to concerns about the potential financial consequences for customers, Binance said it would assume responsibility for all losses resulting from the incident. The exchange intends to use its Secure Asset Fund for Users (SAFU),alongside corporate funds, to meet any compensation obligations.

SAFU is Binance's emergency protection fund established to provide an additional financial safeguard for customers in exceptional circumstances. The company's commitment to use both the fund and its own resources is intended to prevent the security incident from translating into losses for platform users.

Binance also stated that customer funds remain safe. It plans to release an updated Proof of Reserves after remediation is complete, providing customers with additional information about the exchange's assets and its ability to meet obligations.

Blockchain Analysis Reveals Large Cryptocurrency Outflows

Independent blockchain security analysis has provided additional information about the transactions associated with the incident. Security firm Blockaid identified an Ethereum transaction containing 50 authorisations under the EIP-7702 mechanism, directed at a hot wallet labelled Binance 14.

EIP-7702 is an Ethereum protocol feature that allows a wallet to temporarily delegate certain control functions to smart-contract code through a signed authorisation. In the transaction identified by Blockaid, multiple consecutive nonce values were submitted because the attacker could not determine in advance which nonce would be valid when the transaction was processed.

One of the authorisations was accepted, delegating control of the wallet to an unverified contract designed to transfer assets. Blockaid reported that the designated operator address had received funding through Tornado Cash, a cryptocurrency mixing service.

According to the security firm's analysis, the affected wallet was subsequently emptied of approximately $1.6 billion in USDT, 167,464 ETH and more than 60 additional tokens.

Blockaid's assessment of the wider movement of funds also differed from Binance's preliminary estimate. The security firm identified at least $5.57 billion in outflows from Binance-linked wallets across the Ethereum, Bitcoin and Tron networks. The figures use different measurement approaches and should not be treated as directly interchangeable with the exchange's $6.3 billion estimate of total impact.

Bitcoin and Broader Cryptocurrency Market Come Under Pressure

The incident triggered a negative reaction across the cryptocurrency market as traders assessed the potential consequences of a security breach involving one of the industry's largest exchanges.

Bitcoin reportedly fell from above $81,000 to approximately $76,400 during the market reaction. Other major digital assets also recorded declines, with selling pressure extending across the broader cryptocurrency market.

Data from the derivatives market indicated that liquidations reached approximately $1.5 billion as leveraged positions were closed during the price movements. The scale of the liquidations added to market volatility as participants responded to uncertainty surrounding the exchange and the affected assets.

The market reaction came despite Binance's commitment to compensate customers and its announcement that a substantial portion of the affected cryptocurrency had already been frozen.

Investigation and Recovery Efforts Continue

Binance is continuing to work with law enforcement authorities, blockchain intelligence companies and industry partners to establish how the attacker obtained access and to identify the individuals responsible.

The company has not yet released a complete technical explanation of the breach. Its preliminary findings point to a compromised employee device and unauthorised access to a service container, rather than an identified leak of wallet private keys. Further investigation will be required to determine the precise attack sequence and whether additional security weaknesses were involved.

The exchange has committed to publishing a technical post-incident report once the investigation is complete and the findings have been verified. It also intends to provide an updated Proof of Reserves following remediation.

For now, deposits and withdrawals remain subject to the temporary suspension, while efforts to secure the platform, trace the cryptocurrency movements and recover affected assets continue. The final financial impact and the outcome of the recovery operation remain dependent on the findings of the ongoing investigation.