The world's largest cryptocurrency exchange said its initial investigation suggested that the breach may have originated from a compromised laptop belonging to a DevOps engineer, allowing an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
"Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions," the exchange said in a statement.
However, Binance said it had found no evidence of any wallet private key being leaked during the incident.
"We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified," the statement added.
The exchange estimated the total financial impact at around $6.3 billion, adding that it had been working with blockchain partners to freeze the affected assets.
"We have worked with blockchain partners to freeze affected assets, with approximately $3 billion frozen on-chain so far," Binance said.
Assuring users that their funds remained safe, the company said it would cover all losses through its Secure Asset Fund for Users (SAFU) and its own funds.
"Binance will cover all losses from the SAFU fund and the company's funds," it said.
"Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice," the exchange added.
Sharing further details about the incident, Binance co-CEO Richard Teng wrote on X that the initial investigation pointed to a compromised DevOps engineer's laptop as the possible starting point of the attack.
He explained that the breach gave the attacker access to a service container, from where unauthorised withdrawal transactions were submitted.
"To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," Teng said, suggesting that the incident involved a more complex attack process.
I want to speak to you directly about what happened. Bottom line - your money is safe, and we're covering every loss. Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions. To be clear: the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak. We'll share a detailed technical post-mortem once the investigation is complete and every fact is verified - and publish an updated Proof of Reserves once remediation is complete. What you need to know: • Your funds are safe • Binance will cover all losses from the SAFU fund and company funds • Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners • No evidence of any wallet private key leak • Deposits are unaffected and operating as normal What we've done: • Temporarily suspended withdrawals while we complete a security revamp of the withdrawal service and its related addresses • Revoked the affected address authorizations • Engaged law enforcement and blockchain intelligence partners to trace and recover funds Our team hasn't stopped. We're working closely with law enforcement to ensure the matter is handled appropriately - and I'll share what I can, as soon as I can.
— Richard Teng (@_RichardTeng) October 30, 2026
He also stressed that the investigation had not attributed responsibility to any individual and that there was, so far, no evidence of a wallet private key leak.
Steps taken by Binance
Binance said it had taken several immediate measures to contain the incident and strengthen its security infrastructure.
These include:
Temporarily suspending withdrawals while upgrading the security of its withdrawal service and related addresses.
Revoking authorisations associated with the affected addresses.
Working with law enforcement agencies and blockchain intelligence firms to trace and recover the stolen funds.
North Korean hackers suspected
Meanwhile, cybersecurity and cryptocurrency intelligence experts have pointed towards North Korea as the possible source of the attack.
Blockchain intelligence firm TRM Labs attributed the incident to TraderTraitor, an elite North Korean hacking unit, citing what it described as robust on-chain and off-chain intelligence.
"TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence," the firm said in a statement.
TRM Labs added that it was tracking the movement of funds and alerting industry partners through its Beacon Network.
Singapore-based blockchain tracking firm Pangolin Intelligence also said it believed North Korean hackers were behind the incident.
An analyst with the firm, who requested anonymity, told CNN that the assessment was based on an analysis of on-chain transactions and comparisons with previous attacks linked to the North Korean cyber unit.
"I think the cat and mouse game has barely begun yet," the analyst said, adding that North Korea was likely to use a network of money-laundering organisations to convert the stolen cryptocurrency into cash.