● Estimated total impact Around $6.3 billion, per Binance.
● Frozen so far Roughly $3 billion on-chain, described as the current verified total.
● Stated cause A compromised DevOps engineer’s laptop. Binance says it has found no evidence of a wallet private key leak.
● User funds Binance says all losses will be covered from the SAFU fund and company funds, and that user funds are safe.
● Right now Deposits and withdrawals are temporarily suspended.
Figures on this page are Binance’s own. In the first hours of the incident, outflow estimates circulated between roughly $2.8 billion and $5.8 billion from blockchain researchers and news outlets. Binance has since put the estimated total impact at around $6.3 billion. Where a number here differs from an earlier report, it is because this page uses the company statement rather than the earlier estimates. This is an active incident and figures may change again.
What Binance says happened
Binance says its initial investigation suggests the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
The company states it has found no evidence of any wallet private key leak. That distinction matters: a private key compromise would mean the underlying wallets themselves were exposed, whereas the described route is an attacker using internal infrastructure access to submit withdrawals that the system treated as authorised.
Binance says it will publish a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The numbers
| Figure | Amount | Source and status |
|---|
| Estimated total impact | Around $6.3 billion | Binance statement |
| Frozen on-chain | Around $3 billion | Binance, described as the current verified total |
| Covered by Binance | All losses | From the SAFU fund and the company’s own funds |
| Earlier outflow estimates | Roughly $2.8bn to $5.8bn | Blockchain researchers and news reports before the company statement |
Binance says it is working with blockchain partners to freeze affected assets and that it will only share confirmed figures, providing further updates as more verified information becomes available.
What Binance has done so far
- Temporarily suspended deposits and withdrawals while security checks are completed.
- Revoked the affected address authorisation.
- Engaged law enforcement and blockchain intelligence partners to trace and recover funds.
- Committed to covering all losses from the SAFU fund and company funds.
- Committed to publishing an updated Proof of Reserves once remediation is complete.
The company says its teams are working around the clock and that it is working with law enforcement partners to confirm the identity of those responsible.
What this means if you hold funds on Binance
- Deposits and withdrawals are paused. This is stated as a precaution while security checks run, not as a permanent measure.
- Binance says user funds are safe and that losses are covered by the SAFU fund and company funds. SAFU is the insurance fund Binance maintains for exactly this scenario.
- Use official channels only. Binance has asked users to rely on its own announcements, and incidents of this scale reliably attract impersonation accounts and fake "recovery" services. Nobody legitimate will ask for your seed phrase or private keys.
- The updated Proof of Reserves is the number to watch once remediation completes, because it is the verifiable statement rather than the announcement.
What is not yet known
- How the DevOps engineer’s laptop was compromised in the first place.
- How long the attacker had access to the service container before the withdrawals.
- Whether the remaining roughly $3.3 billion that has not been frozen is recoverable.
- Who is responsible. Binance says it is working with law enforcement to confirm identities.
- When deposits and withdrawals will resume.
Binance has said the detailed technical post-mortem will come once the investigation is complete, so most of these answers should arrive in that document rather than in incremental updates.
The detection angle
Security firm Blockaid has said publicly that it detected the outflows using AI models. We have not independently verified the detection timeline or what the models flagged, and Binance’s own statement does not credit an external detection source, so treat that as the firm’s own account pending the post-mortem.
Related
Sources
Published 30 October 2026. This is an active incident and Binance has said it will only share confirmed figures as verification completes. Where this page gives a number, it is the company’s stated figure at time of writing.