Binance estimates the total impact of this week's security incident at approximately $6.3 billion, according to the clearest update the exchange has released since the breach. Roughly $3 billion in affected assets has already been frozen on-chain, and the company says its preliminary investigation found no evidence that wallet private keys were leaked.

According to Binance's initial investigation, the incident may have originated with the compromise of a DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.

"We have found no evidence of any wallet private key leak," Binance said. "We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified."

The exchange laid out the scale of the incident and its response in an official announcement and a statement posted to X on October 30:

The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.

As an immediate precaution, Binance has:

– temporarily suspended deposits and withdrawals while security checks are completed;
– revoked the affected address authorisation;
– engaged law enforcement and blockchain intelligence partners to trace and recover funds.

Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice. Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.

— Binance (@binance) October 30, 2026

Binance Traces Breach to Compromised DevOps Laptop

Binance said the attack may have begun with the exploitation of a laptop belonging to one of the company's DevOps engineers. That access, according to the exchange, enabled the attacker to enter a service container and carry out unauthorized withdrawals.

Machines with that level of access typically hold privileged connections to the systems that keep an exchange running, which is why the compromise of a single endpoint can carry outsized consequences.

A key finding from the preliminary probe, the company emphasized, is that there is no evidence of a private-key compromise — an outcome Binance noted could have created a far more serious security problem. A full technical post-mortem will be released once the investigation is complete and the facts have been fully verified.

$3 Billion in Crypto Already Frozen

Binance now estimates the total losses from the incident at about $6.3 billion, including approximately $3 billion that has been frozen on-chain with the help of blockchain partners. For scale, the figure would exceed the roughly $1.5 billion stolen from Bybit in February 2025, the largest security breach recorded at a crypto exchange before this incident.

The company's statement makes clear that freezing is not the same as recovery, let alone a return to users: frozen funds are assets held in place by investigators so that the flow of money can be traced. The revised $6.3 billion figure is an estimate of the incident's overall impact and does not necessarily represent the amount that will ultimately be recovered.

SAFU Fund and Company Funds to Cover Losses

Binance said the breach will have no financial consequence for customers. Losses will be absorbed by the exchange's Secure Asset Fund for Users (SAFU), an emergency insurance reserve established in 2018, along with company funds, and the company reiterated that user assets are safe. An updated Proof of Reserves, a disclosure through which exchanges demonstrate the holdings backing customer balances — a practice that became an industry-wide transparency measure after the 2022 collapse of FTX — will be published once remediation work is complete.

Immediate Containment Measures

Alongside its public statement, Binance described the initial containment steps taken after the incident was detected. These included halting deposits and withdrawals, revoking the affected address authorization, and bringing in law enforcement and blockchain intelligence firms to help track the funds and identify those responsible. Because on-chain transactions are recorded on public ledgers, specialist firms can follow the movement of stolen funds and flag the addresses holding them.

Withdrawals Remain Under Security Review

The exchange has not yet announced when deposits and withdrawals will return to normal. The company said the temporary suspension will remain in effect until the outstanding security checks are completed, making the ongoing technical investigation the next crucial factor to watch.

Binance is also collaborating with law enforcement to determine who is behind the attack and to seek the recovery of additional lost assets. In the meantime, it has advised users to rely solely on official communication channels and to contact Binance Customer Support with any questions.

The forthcoming technical report is expected to provide more specific detail on how the attacker reached the service container, how the unauthorized withdrawals were approved, and whether further internal controls were affected by the breach.

Reporting by Crypto Ninjas.