Binance Traces $6.3 Billion Theft to a DevOps Engineer's Laptop and a Service Container

Binance said an attacker who compromised a DevOps engineer's laptop may have reached a service container and submitted unauthorised withdrawals worth an estimated $6.3 billion. The exchange posted its security incident update on October 30, 2026.

The update says Binance found no evidence that a wallet private key was leaked, so the attacker did not need the keys that secure the wallets. The route, as described, ran through a laptop, then a container that could request withdrawals, then withdrawals the platform processed as legitimate. That is a finding about internal access controls, not about cryptography.

What Binance has said so far

Binance suspended deposits and withdrawals while it completes security checks, revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners. Inc42 reported that the exchange expects withdrawals to resume within 48 hours; that timeline comes from Inc42's account, not from the text of the announcement as we read it.

The exchange wrote that "Binance will cover all losses from the SAFU fund and the company's funds" and that "User funds are safe." SAFU is the Secure Asset Fund for Users, Binance's emergency reserve. An updated proof of reserves is promised after remediation, along with a technical post-mortem once the facts are verified. The announcement is signed "Binance Team" and names nobody.

Three figures for one theft

The size of the loss depends on who is counting. MediaNama's report, written by Rohit Singh, carries Binance's $6.3 billion estimate and says Chainalysis put the theft at no less than $5.912 billion across Bitcoin, Ethereum, Tron and Ripple. A Chainalysis statement quoted in the same article cites $6.4 billion. MediaNama itself flags the mismatch and calls every number preliminary.

1. Chainalysis, minimum stolen5.91 $B
2. Binance, estimated impact6.3 $B
3. Chainalysis, quoted statement6.4 $B

Source: Binance announcement; MediaNama, which quotes Chainalysis; accessed 2026-10-30

Binance's figure is "estimated total impact", which is not necessarily the same measure as assets stolen. Treat the range as 5.9 to 6.4 until the post-mortem arrives.

Freezes and the Aave loan

Binance says about $3 billion is frozen on-chain. MediaNama lists the issuers behind part of that: Tether about $1.57 billion, Circle more than $800 million, Ripple around $200 million, and World Liberty Financial $27 million in stablecoins plus about $2 million in WLFI tokens. Inc42 quotes Binance co-founder Changpeng Zhao as saying early on that Tether had frozen about $971 million and Circle about $823 million, before later reports raised Tether's figure above $1.5 billion.

Issuer	Amount frozen	Source
Tether	about $1.57 billion	MediaNama
Circle	more than $800 million	MediaNama
Ripple	around $200 million	MediaNama
World Liberty Financial	$27 million plus about $2 million in WLFI	MediaNama

The four named freezes sum to roughly $2.6 billion, short of Binance's $3 billion, so some frozen assets are held by parties no outlet has named.

The attacker also moved stolen funds into lending. MediaNama reported that the attacker posted $60 million in USDT on Aave as collateral and borrowed about $44.6 million in wrapped Ether. Inc42 said Aave suspended new deposits and borrowing across its V3 and V4 markets in response.

Attribution

MediaNama said Chainalysis attributed the attack to North Korea with "a high degree of confidence", citing links between the stolen Binance funds and assets from the September Bitget theft of about $350 million. We could not retrieve Chainalysis's posts, so that attribution rests on MediaNama's account. Binance has not named an actor.

The pattern resembles other access-path failures: in the DHS leak that put 41,000 names online, the dispute was also over how credentials and access groups were reached rather than any broken cipher. Operators who want the patching view of the same week can read how CISA gave agencies three days to patch PHP2Shell.

What happens next

Markets moved on the news. MediaNama reported Bitcoin down more than 3% to $76,368, its lowest in six weeks, and BNB down 5% to $709.70. Binance's next checkpoints are the resumption of withdrawals, which Inc42 puts within 48 hours, the technical post-mortem and the updated proof of reserves. None has a published date.