Binance reports $6.3 billion security incident tied to compromised employee device
Security & Exploits ·
The exchange says an estimated $6.3 billion moved out in unauthorized transactions on October 29, triggering emergency freezes from stablecoin issuers and a market-wide liquidation wave.
Binance's own update attributes the breach to a DevOps engineer's laptop that was compromised, giving an attacker a path into a service container capable of issuing withdrawal requests without needing wallet private keys, according to cryptopotato.com. Tracking of the outflows showed funds moving across several chains, among them Ethereum, Bitcoin, Tron, Arbitrum, Optimism, and Avalanche. Investigators also flagged the use of EIP-7702 authorization signatures, noting that the attacker submitted 50 attempts to align with the wallet's shifting nonce before one went through, enabling execution of malicious code against the account. Binance has not yet published a finalized account of the full attack sequence.
In the hours after the breach became public, Tether moved to freeze above $1.567 billion in USDT, and Circle locked over $800 million in USDC, working alongside law-enforcement contacts. Arbitrum's Security Council took similar action, and combined freezes tied to Binance's response climbed toward roughly $3 billion, a figure still shifting as recovery work continues — part of the broader $2.3 billion in frozen assets attributed to Tether and Circle together. Binance paused deposits, withdrawals, and its Alpha trading product while security reviews were underway. CZ, who remains a major shareholder though no longer runs daily operations, called the episode consistent with a hack and said he expects customers to be made whole. Co-CEO Yi He said the exchange would cover losses using its SAFU reserve and corporate funds.
Markets reacted sharply. Bitcoin dropped close to $76,300, erasing about $478.9 million in positions, with long bets making up 84.6% of that total. Ethereum saw $363.5 million liquidated, Solana lost $82.1 million, and XRP recorded $38.1 million in wipeouts; HYPE stood apart with $31.3 million liquidated, skewed toward shorts. DeFi platforms moved defensively — Aave froze 175 markets across 16 networks on its V3 deployment plus another 117 on V4, while Kamino suspended SOL and BTC borrowing as a precaution.
A possible link to an earlier Bitget exploit has also surfaced. Blockchain investigator ZachXBT reported that funds stolen in both incidents converged at the same wallet after routing through THORChain, suggesting a single actor may be responsible for both breaches, per cryptopotato.com. The Bitget incident had previously been tied to the North Korea-linked TraderTraitor group. Binance's investigation remains open, leaving the precise attack chain, the final recovered amount, and any confirmed connection to the earlier exploit unresolved.