Binance says its preliminary investigation into the largest cryptocurrency breach on record points to a compromised laptop belonging to one of its DevOps engineers, as the exchange puts the total impact of the incident at around $6.3 billion.
In an update published on Friday, October 30, Binance said the laptop compromise may have allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. The company stressed that the finding is preliminary, that it has found no evidence of a wallet private-key leak, and that a detailed technical post-mortem will follow once the investigation is complete and the facts are fully verified.
About $3 billion frozen so far
Binance said it had worked with blockchain partners to freeze approximately $3 billion in affected assets on-chain. That figure has risen from an initial verified $2.54 billion as issuers and partners acted on the incident.
Stablecoin issuers account for much of the frozen total. Tether said it had frozen more than $1.567 billion in USDT linked to the incident, while Circle said it had frozen more than $800 million in USDC. The Arbitrum Security Council was reported to have frozen about $30.5 million.
Binance has said it will cover all losses using its Secure Asset Fund for Users (SAFU) and its own funds, and that user funds are safe. It temporarily suspended deposits and withdrawals while conducting security checks, revoked the affected address authorisation, and said it expected withdrawals to resume within 48 hours.
What the laptop finding does — and does not — prove
The distinction matters. A compromised laptop giving access to a service container is not the same as a wallet private key being stolen. Blockchain security firm Blockaid’s preliminary assessment, reported by CoinTelegraph, pointed to “key misuse” — attackers tricking or compromising a signing system into authorising malicious transactions without extracting the underlying private key.
Blockaid’s on-chain analysis also said the attacker bundled 50 EIP-7702 authorisations into a single transaction targeting a Binance wallet, a technical detail that helps explain how so much value could move so quickly. That analysis remains preliminary, as does Binance’s own account.
Attribution remains an analysts’ assessment
Binance itself has not named an attacker in this update. Separately, blockchain intelligence firm TRM Labs said it had “high confidence” the hack was orchestrated by TraderTraitor, a North Korea-linked hacking operation associated with the Lazarus Group, citing on-chain and off-chain intelligence. That attribution should be read as an investigators’ assessment, not as a confirmed finding by Binance.
Estimates of the amount taken also vary by source and method. Binance puts the total impact at around $6.3 billion, while Chainalysis estimated about $5.912 billion stolen at the time of theft. The gap between “impact” and “stolen” estimates is one reason the final figure may still move as the investigation and recovery work continue.
What happens next
Binance is working with law enforcement, token issuers and blockchain intelligence partners to trace and freeze further assets. It has promised an updated Proof of Reserves once remediation is complete, and a full technical post-mortem once the facts are verified.
For users, the immediate questions are practical: when withdrawals fully normalise, how much of the frozen $3 billion can ultimately be recovered, and whether the post-mortem confirms the laptop route — or points somewhere else. Until that post-mortem lands, the laptop explanation should be treated as Binance’s leading preliminary theory, not a closed case.
Frequently asked questions
Is my money on Binance safe?
Binance says user funds are safe and that it will cover all losses from SAFU and its own funds. It has reported no evidence of a wallet private-key leak, but its investigation is ongoing.
How much has been frozen?
About $3 billion in affected assets had been frozen on-chain as of Binance’s October 30 update, out of an estimated total impact of around $6.3 billion.
Who was behind the hack?
Binance has not named an attacker. TRM Labs has attributed the hack with high confidence to TraderTraitor, a North Korea-linked group, but that is an analysts’ assessment, not Binance’s confirmed finding.
Sources
- CoinTelegraph: https://cointelegraph.com/news/binance-hack-may-involve-private-key-misuse-not-theft-blockaid-ceo
- The Hacker News: https://thehackernews.com/2026/10/binance-suffers-security-breach.html
- The Straits Times: https://www.straitstimes.com/business/crypto-platform-binance-confirms-major-hack-more-than-us2-5-billion-frozen
- Times of India: https://timesofindia.indiatimes.com/business/international-business/worlds-largest-crypto-exchange-binance-freezes-2-54-billion-after-suspected-hack/articleshow/135338439.cms
- Earlier Emadan report on the hack: https://emadan.store/binance-hack-2026/
