On October 29, 2026, Binance reported unauthorized withdrawals from its hot wallets. The exchange estimates the impact at about $6.3 billion.
Its initial investigation points to a compromised DevOps engineer’s laptop, which may have given access to a service container and allowed the withdrawals. Binance says there is no evidence that wallet private keys leaked, has revoked the affected address authorization, and reports that about $3 billion in assets is frozen on-chain. Losses will be covered from SAFU and company funds.
What is still unknown
The full attack path, which controls were bypassed, who the attackers are, and the final independently verified loss figure. These are Binance’s statements as of October 30, not the result of an independent audit. A detailed post-mortem is expected.
The key question is not only whether a private key was stolen, but whether a compromised endpoint could reach a production transaction path with no independent control stopping the request.
