Binance's investigation into its recent security incident has expanded beyond a single compromised DevOps laptop, with investigators identifying additional points of entry into the exchange's systems. Withdrawals remain suspended for approximately 45 hours while the company maps the full attack path, and Binance has committed more than $6.34 billion in corporate funds to cover confirmed losses. Deposits, meanwhile, remain fully operational. The result is an exchange running in a deliberately partial state — assets flowing in, none flowing out — while forensics and reimbursement preparations proceed in parallel.

Additional Breach Points Found Beyond a Single Laptop

Binance initially linked the incident to the possible compromise of a DevOps engineer's laptop, through which attackers may have gained access to a service container and submitted unauthorized withdrawal requests. Subsequent investigation has uncovered additional ways into the system, and the security team is now working to map the complete attack path while continuing to trace the computer believed to be the initial point of entry.

The exchange has not yet provided a full technical account of how attackers made use of the newly identified access points, and until that account is published the full scope of attacker access remains unconfirmed. It did, however, state that it found no indication that wallet private keys were leaked. A detailed technical report is planned once the investigation concludes, in line with earlier reports that the hack involved more than a single laptop.

Withdrawals Paused for Approximately 45 Hours

In an X post and support announcement, Binance said withdrawals remain paused while its security team reviews the affected withdrawal service and related addresses — work the company expects to take roughly 45 hours before withdrawals resume. The pause is framed as time-boxed rather than open-ended, making the completion of that review the marker for when outbound transfers resume.

As immediate containment measures, Binance revoked the affected address authorization and halted withdrawals — steps taken before the investigation could establish the full attack path. It has also engaged law enforcement and blockchain intelligence firms to help trace the stolen funds. Deposits continue to operate as normal, meaning users can send assets to the platform but cannot withdraw funds until the review is complete.

$6.34 Billion Set Aside to Cover User Losses

Binance said it is recovering affected assets for users and has earmarked more than $6.34 billion in corporate funds to cover estimated losses. About $5 billion of that total is already held in the same tokens affected by the incident, with the exchange acquiring the remainder on the open market and through OTC desks to match what users are owed, according to a later Binance update. Because the commitment draws on corporate funds rather than frozen assets, the reserve stands independently of how much is ultimately recovered — and its final composition will come into focus as the outstanding token purchases close.

Some token purchases may take longer to complete due to thin liquidity and OTC settlement timelines, and Binance said it will publish further updates as the buying progresses. Separately, industry partners have helped freeze approximately $3 billion in affected assets. Those frozen funds still require recovery verification and are not included in the $6.34 billion reserve. The company said it is working with law enforcement, token issuers, on-chain intelligence firms, and industry partners to pursue additional recoveries.