Binance released its initial findings on October 29 regarding a security incident with an estimated $6.3 billion impact, pointing to a possible compromise of a DevOps engineer's laptop as the source of unauthorized withdrawal transactions.
According to the exchange's preliminary investigation, an attacker gained access through the compromised laptop to a service container, enabling them to submit unauthorized withdrawals. Binance stated it found no evidence of any wallet private key leak during its review.
Asset Freezes and Loss Coverage
Blockchain partners have frozen approximately $3 billion in affected assets on-chain so far, according to Binance's assessment. The company engaged law enforcement and blockchain intelligence partners to trace and recover funds while working to confirm the attackers' identities.
Binance committed to covering all losses through its Secure Asset Fund for Users (SAFU) and corporate funds. A conversion of SAFU reserves into bitcoin began in February under a plan to shift $1 billion in stablecoin reserves.
Operational Response
Deposits and withdrawals were suspended while security checks continued. Binance revoked authorization for the affected address and stated that withdrawal resumption would depend on completion of the security scan. Co-founder and co-CEO Yi He indicated that withdrawals would be enabled once the scan was complete.
The company committed to releasing an updated disclosure through its proof of reserves system following remediation and promised a detailed technical post-mortem once the investigation concludes and facts are fully verified.
