Binance identifies a likely entry point
Binance has published its first detailed preliminary account of the security incident, saying the attack may have started with a compromised DevOps engineer's laptop.
According to the exchange, the attacker used that access to reach a service container and submit unauthorized withdrawal transactions. Binance says its investigation has found no evidence of a wallet private-key leak.
This is a material change from the earlier phase of the incident, when public analysis focused on EIP-7702 activity and possible signing-key compromise. Binance's statement does not yet provide enough technical detail to independently reproduce the access path, so the DevOps explanation remains a preliminary finding pending the promised post-mortem.
Binance estimates a $6.3 billion impact
The exchange now puts the estimated total impact at approximately $6.3 billion. It says blockchain partners have frozen about $3 billion on-chain so far.
Those figures supersede earlier snapshots that placed the attributed cross-chain drain near $5.6 billion and verified freezes near $2.54 billion. They remain estimates rather than a final reconciled loss statement. Frozen assets are immobilized, but they are not necessarily recovered until issuers, Binance and relevant authorities complete the required recovery, burn, reissuance or redemption steps.
The difference between the $6.3 billion gross impact and approximately $3 billion frozen also does not automatically equal Binance's final loss. Prices can move, more assets may be frozen or recovered, and some balances may be duplicated across preliminary tracking datasets.
SAFU and company funds will cover losses
Binance says it will cover all losses using the SAFU emergency fund and company funds. It also says user funds remain safe and promises an updated Proof of Reserves after remediation is complete.
That provides more detail than the exchange's earlier assurances and CZ's statement that losses would be covered. The updated Proof of Reserves will be important because it should show whether affected customer assets have been fully replaced and how the exchange restored its backing ratios.
Deposits and withdrawals remain temporarily suspended while Binance completes security checks, revokes affected authorizations and works with law enforcement and blockchain-intelligence partners.
What the preliminary explanation does not prove
The official statement narrows the leading theory, but several questions remain open:
- how the DevOps laptop was compromised;
- which service container and credentials were exposed;
- how the attacker bypassed withdrawal controls;
- which wallets and networks were affected;
- whether any signing service was abused without leaking its underlying keys;
- and how much of the approximately $3 billion frozen will ultimately be recovered.
The distinction between a private-key leak and unauthorized access to a system capable of initiating withdrawals is critical. A key can remain technically secret while an attacker abuses software, credentials or authorization paths around it.
The current precise formulation is: Binance's preliminary investigation points to a compromised DevOps laptop and service-container access, estimates $6.3 billion was affected, says approximately $3 billion is frozen and reports no evidence of a wallet private-key leak. The full technical cause is not yet independently verified.
Read Signal21's complete incident timeline and the update on suspended deposits and withdrawals.
This is a developing story. Signal21 will update the article when Binance publishes its technical post-mortem or restores deposits and withdrawals.