← Binance

2026 Binance — security incident: unauthorised withdrawals after a DevOps laptop was compromised; about $6.3B in assets affected (company figure)

2026 Unknown records affected Share on X

Data compromised

Crypto assets held in affected hot wallets across ten blockchains. Binance says user funds are safe and that it is recovering affected assets for users. Reporting says Binance will cover all losses from the SAFU fund and company funds; the article gives this as a paraphrase, not a direct quote. The sources reviewed report no personal data exposure.

Technical writeup

Binance's first statement, around 21:29 UTC on October 29, said it was investigating and that user funds were safe. TRM Labs says funds left Binance wallets from about 20:05 UTC on October 29, mostly within about 20 minutes. Binance suspended deposits and withdrawals and revoked authorisations for the affected address. Binance says about $6.3 billion in assets were affected and nearly $3 billion had been frozen on-chain in its initial statement. Outside estimates differ: Chainalysis put the theft at about $5.9 billion and Elliptic at about $6.43 billion. Binance says withdrawals remain paused during further security reviews.

Root cause

Binance links the theft to a compromised laptop used by a DevOps engineer. The attacker reached a service container and submitted unauthorised withdrawals. Binance says it has found no evidence of a leaked wallet private key. Co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions" and that the investigation has not attributed responsibility to any individual. Binance has not named a group. TRM Labs attributes the attack to TraderTraitor, a North Korea-linked group, and Chainalysis said it agreed with TRM's findings.

References

Breaches you may like