Binance has reported a major security breach involving approximately $6.3 billion in cryptocurrency, potentially making it the largest hack in the industry's history.
The incident occurred on October 29, 2026, with the exchange providing further details the following day.
According to Binance's preliminary findings, attackers gained unauthorized access to internal infrastructure and initiated fraudulent withdrawal transactions.
The exchange has temporarily suspended deposits and withdrawals while security teams investigate the incident.
Binance emphasized that the reported losses remain preliminary and could change as investigators identify additional transactions.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
— Binance (@binance) October 30, 2026
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
— Binance (@binance) October 30, 2026
Compromised Employee Laptop Suspected
Binance's initial investigation points to a compromised laptop belonging to a DevOps engineer as the possible entry point.
The attacker allegedly used the device to access an internal service container capable of submitting withdrawal requests.
Binance said it had found no evidence that wallet private keys were exposed.
However, blockchain security company Blockaid identified suspicious activity involving Binance's Ethereum hot wallets.
According to Blockaid, attackers used EIP-7702 authorizations to delegate control of a major wallet to a malicious smart contract.
The mechanism reportedly enabled unauthorized transfers without requiring direct possession of the wallet's private key.
Binance plans to publish a detailed technical investigation after verifying the attack's circumstances.
Blockchain Firms Freeze Nearly $3 Billion
Cryptocurrency companies and blockchain networks have reportedly frozen approximately $3 billion connected to the incident, limiting the attacker's ability to move some of the stolen assets.
Tether CEO Paolo Ardoino confirmed that the company froze approximately $1.567 billion in USDT.
Circle CEO Jeremy Allaire also reported freezing more than $800 million in USDC. Other organizations involved in the response reportedly include Ripple, Paxos, BitGo and World Liberty.
Meanwhile, Arbitrum's Security Council froze approximately $30.5 million in affected assets.
Decentralized lending protocol Aave also temporarily froze its DAO-operated lending markets as a precaution.
Despite these interventions, approximately $3.3 billion reportedly remains outside the reach of recovery efforts.
Blockaid Identifies Coordinated Hot Wallet Attack
Blockchain security firm Blockaid traced a major portion of the incident to Binance 14, one of the exchange's busiest Ethereum hot wallets.
Its analysis suggests the attacker prepared transactions on October 28 before executing the main exploit the following day.
At approximately 20:20 UTC, the attacker reportedly submitted 50 EIP-7702 authorizations, increasing the chances that one would match the wallet's active transaction nonce.
Within minutes, approximately 167,464 ETH, 1.615 billion USDT and dozens of other tokens were transferred, with an estimated value of $2.5 billion.
Additional withdrawals reportedly affected ten other Binance hot wallets across several blockchain networks.
Blockaid's findings suggest compromised signing infrastructure, although the complete technical explanation remains under investigation.
Binance Promises to Cover Customer Losses
Binance says its emergency SAFU fund and corporate reserves will cover customer losses associated with the incident.
The exchange has also revoked affected authorizations and is cooperating with law enforcement and blockchain intelligence companies.
An updated Proof of Reserves report is expected after remediation.
Meanwhile, blockchain investigator ZachXBT has suggested possible involvement by North Korea's Lazarus Group, but no official attribution has been confirmed.
The incident's reported $6.3 billion scale would significantly exceed the approximately $1.5 billion Bybit hack in February 2025.
However, the full financial impact, recovery totals and attack mechanism remain subject to verification.
For now, Binance users are being directed to official exchange channels for security updates, while investigators continue tracing the affected funds.
