Binance has confirmed it suffered a security breach resulting in the unauthorized withdrawal of funds valued at an estimated $6.3 billion, making it the largest theft in the history of cryptocurrency exchanges. The exchange said the incident originated from the compromise of a laptop belonging to one of its DevOps engineers, giving attackers a route into a service container from which they executed withdrawal transactions without authorization.
Binance stated there is no evidence that the private keys of its wallets were leaked, framing the breach as a matter of infrastructure access rather than a compromise of the custody system itself. The company said it has worked with blockchain intelligence firms to trace and freeze the stolen assets, and that it has so far frozen approximately $3 billion on-chain. CriptoNoticias reported the previous day that other companies across the crypto ecosystem had also cooperated in the tracking effort.
The exchange guaranteed it will cover all user losses, drawing on both corporate funds and its Secure Asset Fund for Users, known as SAFU, which was created to reimburse users in the event of security incidents. Binance also committed to publishing an updated Proof of Reserves once repairs to its affected infrastructure are complete, giving users a way to verify that its holdings match client balances once the dust settles.
Withdrawals still paused
As an initial precaution, Binance temporarily suspended deposits and withdrawals across the platform, revoked authorizations tied to the affected addresses, and notified law enforcement. In a later update published in the early hours of October 30, the exchange said deposits were already operating normally again.
Withdrawals, however, remain paused while Binance's security team restructures the affected service and related addresses. The exchange estimated that withdrawals would resume within a maximum of 48 hours.
Binance indicated that the incident resulted from a combination of factors rather than a single point of failure, and said it would publish an exhaustive report detailing the root cause once the full attack path has been traced. No timeline was given for when that report would be released, and Binance has not disclosed the identity or origin of the attackers, nor the precise mechanism by which access to the engineer's laptop translated into control over the service container.
For a platform that has long positioned its reserve fund and proof-of-reserves practices as evidence of resilience, the scale of the breach — and the pledge to make users whole regardless of cost — will test both claims in the weeks ahead as the frozen funds are either recovered or written off against Binance's own balance sheet.
