Binance has put a number and a cause on the Binance hack: about $6.3 billion, traced to a single compromised laptop. In an official statement on X at 02:25 UTC on 30 October, the exchange sai
Binance has put a number and a cause on the Binance hack: about $6.3 billion, traced to a single compromised laptop. In an official statement on X at 02:25 UTC on 30 October, the exchange said its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop." The laptop "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." At $6.3 billion, it would be the largest crypto theft on record, more than four times the $1.5 billion taken from Bybit in February 2025.
Binance also confirmed for the first time how it will pay: "Binance will cover all losses from the SAFU fund and the company's funds."
The statement gives the first official loss figure since the drain began at 20:24 UTC on 29 October: "The estimated total impact sits at around $6.3B." Of that, "~$3 billion" is "frozen on-chain so far." Binance said it has found "no evidence of any wallet private key leak," has "revoked the affected address authorisation," and will publish "an updated Proof of Reserves once the remediation is complete." Deposits and withdrawals stay suspended, and a "detailed technical post-mortem" will follow.
The statement, which links to a Binance support announcement, adds that Binance is "working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice." It is the first time the exchange has described the attackers as criminals, after hours of calling the incident only a "potential security issue."
The "no private key leak" line fits the on-chain evidence better than it first appears. FinanceFeeds' first report showed that a Tornado Cash-funded address switched a Binance hot wallet to run its own contract through an EIP-7702 delegation, which requires a valid signature from the wallet. If the attacker controlled a service container that is allowed to request signatures, they could get valid signatures without ever seeing the key. They did not need to steal the key, only to reach the machine that uses it.
That is the same pattern as the Bybit breach, where attackers compromised a developer machine at wallet provider Safe and used it to push a malicious transaction that Bybit's signers approved. The two largest exchange thefts on record now both trace back to one engineer's computer rather than to broken cryptography. For brokers and custodians, that shifts the audit question from how keys are stored to who and what can ask for a signature.
With $6.3 billion lost and about $3 billion frozen, roughly $3.3 billion is still outside Binance's reach. The SAFU fund, which Binance filled with $1 billion in Bitcoin earlier this year, covers less than a third of that. The rest, at least $2.3 billion before any further recoveries, would come from Binance's corporate balance sheet. That explains why the statement names "the company's funds" alongside SAFU, extending the "cover all losses" pledge Binance made at 00:13 UTC.
The new figure also puts the freeze in context. When Binance reported about $3 billion frozen, that looked like most of the loss on the $3.3 billion Ethereum estimate. Against $6.3 billion, it is under half. The rest is mainly Bitcoin and ETH, which issuers cannot freeze.
The market took the disclosure as clarity rather than shock. BNB rose to $712.88 at 02:34 UTC, trimming its 24-hour loss to 4.4% from more than 8% earlier in the night, according to CoinGecko. Bitcoin traded at $77,183.
Three things will decide whether that holds: the updated Proof of Reserves, a reopening date for withdrawals suspended since 22:15 UTC, and the post-mortem's account of how one laptop reached a signing service. Binance's first statement on the incident was edited twice in 13 minutes. Tonight's disclosure is the first to give a loss figure, a cause and a funding source. No government agency or regulator has commented publicly. FinanceFeeds will update this coverage as official information arrives.
