Binance discloses $6.3 billion security incident tied to compromised employee laptop
Security & Exploits ·
The exchange says unauthorized withdrawals were pushed through after an attacker gained entry via a DevOps staffer's device, with roughly half the affected funds already frozen.
Binance has confirmed a security breach with an estimated total impact of $6.3 billion, which it attributes to a compromised laptop belonging to a DevOps engineer rather than a broader system failure. According to the exchange, the laptop's access let an intruder reach a service container and push through withdrawal transactions that were never authorized, though the company has said it found no sign of a leaked private key. A full technical review is promised once the investigation wraps up.
Of the $6.3 billion total, Binance says about $3 billion has already been frozen on-chain through cooperation with blockchain partners and other service providers, leaving roughly $3.3 billion still outstanding. The exchange has paused all deposits and withdrawals while it runs security checks, cut off authorization for the compromised address, and brought in law enforcement and blockchain-intelligence firms to try to trace and recover the remaining funds, per CryptoPotato's reporting.
Binance has stated that customer balances will not be affected, pledging to absorb the entire loss through its SAFU insurance fund together with company capital, and says it will issue a refreshed proof-of-reserves report once remediation is finished. Multiple accounts of the incident circulating since the disclosure converge on the same root cause — a compromised DevOps laptop enabling unauthorized withdrawal activity — with four separate outlets having picked up the story, lending consistency to the $6.3 billion figure and the $3 billion frozen-asset tally.
The disclosure rattled markets immediately: bitcoin fell from above $81,000 to around $76,400 as news spread, dragging altcoins down with it, and derivatives data showed roughly $1.5 billion in liquidations across the sector. Some market participants characterized the price reaction as comparatively contained given the scale of what is being described as the largest exchange hack in recent memory.
What remains unclear is how the attacker obtained access to the engineer's laptop in the first place, the exact mechanism — described elsewhere as involving EIP-7702 — used to execute the unauthorized withdrawals, and whether the roughly $3.3 billion still unfrozen can be recovered. Binance has not yet published the detailed post-mortem it promised, and a timeline for restoring deposits and withdrawals or releasing an updated proof-of-reserves has not been given.