Binance says October 29 breach reached $6.3 billion, tied to a compromised laptop
Security & Exploits ·
Binance's preliminary review points to a single DevOps engineer's laptop as the entry point for an unauthorized-withdrawal incident the exchange now pegs near $6.3 billion.
According to Binance's own update, attackers used the compromised machine to reach a service container and push through withdrawal transactions without needing a private key leak, as the exchange has stated. Investigators tracing the outflows found activity spread across Ethereum, Bitcoin, Tron, Arbitrum, Optimism, and Avalanche, and also flagged the use of EIP-7702 authorizations — 50 were submitted to try to align with the wallet's shifting nonce, and one attempt succeeded, letting malicious code run against the affected wallet, per reporting from CryptoPotato. The full chain of how the breach unfolded has not been confirmed, and the inquiry is ongoing.
Stablecoin issuers moved quickly: Tether locked down more than $1.567 billion in USDT and Circle froze over $800 million in USDC, working alongside law enforcement, while Arbitrum's Security Council and other token issuers froze additional holdings, pushing Binance's recovered total toward roughly $3 billion against the broader $2.3 billion figure cited for combined freezes — leaving a large share of funds still unaccounted for. Binance's Co-CEO said the company will cover user losses through its SAFU fund and its own resources, and deposits, withdrawals, and Binance Alpha trading were paused temporarily for security checks.
The fallout spread quickly into derivatives markets. Bitcoin dropped near $76,300, triggering about $478 million in liquidations, with longs making up the large majority of that figure, while Ethereum, Solana, XRP, and HYPE positions were also wiped out in smaller amounts. DeFi platforms reacted defensively too, with Aave freezing a large number of markets across multiple networks and Kamino halting certain borrowing activity as a precaution.
Separately, blockchain investigator ZachXBT has pointed to a possible connection between this breach and the earlier Bitget exploit, noting that funds from both incidents passed through THORChain before landing in the same wallet — a pattern he says suggests one attacker may be responsible for both, with the Bitget case previously linked to a North Korea-associated hacking group.
What remains unresolved is the exact mechanism that let the compromised laptop escalate into withdrawal access, the final tally of funds successfully frozen versus funds still moving, and whether the suspected link to the Bitget exploit will be formally confirmed. Reports of additional breach points beyond the original laptop, found by Binance's security team, suggest the scope of the incident may still be expanding.