Binance Links $6.3 Billion Hack to Compromised DevOps Engineer's Laptop
Key Takeaways
- •Binance's initial investigation identified a compromised DevOps engineer's laptop as the likely entry point, potentially enabling an attacker to access a service container and submit unauthorized withdrawals.
- •The exchange estimated the incident's total impact at roughly $6.3 billion and froze about $3 billion in stolen assets, which would exceed the February 2025 Bybit theft as the largest reported crypto hack.
- •Neither Binance nor security firm Blockaid found evidence that wallet private keys were extracted, with both describing the breach as a compromise of signing infrastructure through key misuse.
- •Blockaid's onchain analysis showed the attacker bundled 50 EIP-7702 authorizations into a single transaction, with the affected account delegated to an unverified sweeper contract capable of draining tokens and Ether.
- •Binance stated that user funds are safe and losses will be covered by its SAFU insurance fund and company funds, while deposits and withdrawals were temporarily suspended during security checks.
Update (Oct. 30 at 2:44 am UTC): This article has been updated to include Binance's preliminary investigation into the security breach.
Binance's initial investigation into the multi-billion-dollar crypto breach points to a compromised DevOps engineer's laptop. The exchange said on Friday that the compromise may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. It added that it had found no evidence of a wallet private-key leak, while stressing that its investigation remains ongoing.
Blockaid's preliminary assessment points in the same direction. Speaking to Cointelegraph on Thursday, Blockaid CEO Ido Ben-Natan said the incident appeared to involve "key misuse," in which attackers tricked or compromised a signing system into authorizing malicious transactions without extracting the underlying private key.
"It seems to be … a compromise of signing infrastructure. We don't think a key was leaked," he said. Ben-Natan's assessment drew on Blockaid's experience with similar attacks and its observations of the onchain activity.
Binance estimates $6.3 billion impact, freezes about $3 billion
Binance announced its preliminary findings in a statement on X, putting the estimated total impact of the incident at around $6.3 billion and saying it had worked with blockchain partners to freeze approximately $3 billion in stolen assets onchain. If confirmed, the estimate would exceed the February 2025 Bybit theft, until now the largest reported hack in crypto history.
The exchange said it would cover all losses using its Secure Asset Fund for Users (SAFU) and company funds, adding that user funds were safe. SAFU is an emergency insurance fund Binance created in 2018, financed by a portion of trading fees and designed to cover user losses in extreme cases. It also pledged to publish an updated Proof of Reserves, the cryptographic method exchanges use to demonstrate they hold the assets backing customer balances.
Deposits and withdrawals were temporarily suspended while security checks were carried out, and Binance said it had revoked the affected address authorization. The company is working with law enforcement and blockchain intelligence partners to trace and recover the funds, and it said it would publish a detailed technical post-mortem once the investigation is complete and the facts fully verified.
Blockaid identifies malicious wallet delegation
In an onchain analysis published on X, Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One authorization reportedly matched the account's required nonce, allowing it to be accepted.
EIP-7702, which went live with Ethereum's Pectra upgrade in May 2025, allows an account to delegate execution to smart-contract code. Blockaid further detailed that the affected account was delegated to an unverified sweeper contract, which allowed a designated operator to drain tokens and Ether.
Related: Binance hack rattles crypto markets as BNB falls 7%, Bitcoin slides
Ben-Natan told Cointelegraph that the operation could have involved multiple compromised devices and movement through the exchange's internal network.
Before Binance's latest update, Arkham CEO Miguel Morel told Cointelegraph there was insufficient information to determine whether the attack involved stolen keys or compromised infrastructure. "From what we can tell, it appears the hack is still ongoing," he said at the time.
North Korea, Bybit comparison
Asked whether the suspected signing manipulation resembled the February 2025 Bybit attack, Ben-Natan described the two incidents as "very, very similar." In that case, Bybit's published forensic update said attackers compromised a Safe developer's credentials, accessed the wallet provider's infrastructure and deceived signers into approving a malicious transaction. The FBI attributed that theft, estimated at roughly $1.5 billion, to North Korean-linked hackers.
Ben-Natan also said the activity resembled operations linked to North Korea, citing Blockaid's familiarity with those attacks. He pointed to sophisticated onchain preparations but emphasized that the attribution remained unconfirmed.
Binance has not identified the attackers, saying it is working with law enforcement to establish their identities.
Magazine: Tampered Ledger reported in Singapore a month before news broke: Asia Express
