Binance probes intrusion after $6.3B impact estimate

Binance said on Oct. 29 that it was investigating a security incident with an estimated impact of about $6.3 billion, raising questions about unauthorized withdrawals from the exchange. The Associated Press report published by The Washington Post said Binance had not confirmed that funds were stolen, and the extent of any losses was unclear.

How could the attacker submit withdrawal transactions?

Binance’s initial investigation points to a possible chain of access: a DevOps engineer’s laptop may have been compromised; that may have let an attacker reach a service container; and the attacker may then have submitted unauthorized withdrawal transactions. A service container is a software environment used to run part of a system. Binance has not published a completed technical account of how the suspected access led to the transactions.

The distinction matters. Binance said it had found no evidence that wallet private keys were leaked. That does not establish how many transactions succeeded or how much was lost. The company’s $6.3 billion estimate describes the total impact it reported, not a confirmed theft figure.

How much has Binance traced or frozen?

Binance said about $3 billion in affected assets had been frozen on-chain as of its Oct. 30 update. That means the assets were immobilized on their blockchains, so they could not be moved through those addresses while the freeze held. The figure may change as tracing continues. Binance said law enforcement, issuers, blockchain intelligence firms and industry partners were helping trace and freeze assets.

The exchange also said stablecoin providers Tether and Circle had frozen funds linked to the incident. Those freezes can restrict some assets, but they do not by themselves establish the full amount affected or recovered.

What did Binance say about customers and withdrawals?

Binance said it would cover losses using its Secure Asset Fund for Users, or SAFU, and company resources. It said deposits were operating normally after its initial service disruption, while withdrawals remained paused during security work. The company expected withdrawals to resume within 48 hours of the update.

In its Oct. 30 official update, Binance said it would publish a post-mortem and updated proof of reserves after remediation. Until that review is complete, the suspected laptop-to-container route remains an initial theory. The published figures describe the exchange’s current estimate and freeze tally; they do not yet provide a verified account of the incident’s root cause or net losses.

Sources

• Associated Press report published by The Washington Post — washingtonpost.com
• Oct. 30 official update — binance.com