Binance said a security incident has had an estimated total impact of approximately $6.3 billion, with blockchain partners helping the cryptocurrency exchange freeze about $3 billion of affected assets on-chain so far.
The company’s initial investigation indicates that a DevOps engineer’s compromised laptop may have let an attacker access a service container and submit unauthorized withdrawal transactions.
Binance said it has found no evidence that any wallet private keys were leaked.
The cryptocurrency exchange plans to publish a detailed technical post-mortem after it completes its investigation and fully verifies the underlying facts.
Binance said it will cover all losses from the incident using its Secure Asset Fund for Users (SAFU), as well as company funds. The exchange emphasized that user funds remain safe.
Binance founder Changpeng Zhao, known as CZ, also addressed the losses publicly on X. Responding to a post estimating the remaining loss at roughly $1 billion after asset freezes, Zhao said the loss could be slightly higher but would be covered.
Loss might be a bit higher than that, but will cover. 🙏
— CZ 🔶 BNB (@cz_binance) October 29, 2026
His comment came before Binance disclosed the later estimate of approximately $6.3 billion in total impact and roughly $3 billion frozen on-chain.
Zhao also had an exchange with Elon Musk during online discussion of the incident. After Musk responded with a grimacing emoji in the thread, Zhao asked him to stop trolling during what he described as a bad time for Binance.
Zhao also pointed to Binance’s financial ties to Musk’s social media company, saying the SPCX shares from its $500 million investment in Musk’s Twitter acquisition were worth more than $1 billion.
As part of its immediate security response, Binance temporarily suspended withdrawals while it conducts additional security checks.
The company also revoked the affected address authorization and engaged law enforcement agencies and blockchain intelligence partners to trace and recover funds connected with the incident.
Deposits remain unaffected and are continuing to operate normally, according to an updated version of the company’s announcement.
Binance said it is working with law enforcement partners to identify the individuals responsible for the incident and pursue recovery efforts.
The company also plans to publish an updated Proof of Reserves after remediation work is completed.
The incident highlights the operational security risks facing cryptocurrency platforms even when wallet private keys themselves are not compromised. According to Binance’s preliminary assessment, the suspected breach involved access to internal infrastructure through an employee device rather than direct exposure of wallet keys.
Binance has not yet released a complete technical explanation of how the compromised device enabled access to the relevant service container or how the unauthorized transactions were executed.
The exchange cautioned that its investigation remains ongoing, meaning additional details about the incident, its impact, and recovery efforts could change as more information becomes available.
