Binance Points to Compromised DevOps Laptop in $6.3B Hack, No Key Leak Found

Published October 30, 2026, 08:45 AM PKT. This is a follow-up to MABOnChain's October 30 articles on Binance's investigation into a suspected multi-billion wallet drain, its pause of withdrawals on multiple networks, and its pledge to cover all losses and suspend all deposits and withdrawals. It is based on Binance's first detailed findings, published in an update on X in the early hours of October 30, 2026, as reported by PANews, TokenPost, Bitcoin.com, BeInCrypto and TechNode (primary source for the cause, the $6.3 billion estimate, the freeze total, the funding plan and the promised post-mortem), and on CoinDesk's proof-of-reserves analysis, Chainalysis's estimate, Reuters market reporting and CoinTelegraph's live updates (secondary sources).

Binance has named a possible cause for the largest exchange incident on record, and it has published its first loss figure. In its update, Binance said its initial investigation suggests the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. Binance said it has found no evidence of any wallet private key leak, and that it will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3 billion, Binance said, with about $3 billion frozen on-chain so far. That $6.3 billion figure is Binance's own estimate, and it replaces the position MABOnChain reported in its three earlier articles on this incident, in which Binance had published no loss figure at all and every large number carried an outside source's name.

The laptop and the service container

The statement is preliminary, and its wording matters. Binance said the incident "may involve" a compromised laptop, not that investigators have proven the entry point, and it did not say how the laptop was compromised, when the compromise happened, or whether the attacker still has any access. What it does say is where the attacker went next: a service container, a packaged software environment that runs part of an exchange's withdrawal machinery, from which unauthorized withdrawal transactions were submitted. Binance also said it has revoked the affected address authorization, a step that cuts off the compromised route even before the full investigation ends. The statement does not explain the delegation mechanism that outside researchers flagged in the first hours, when Arkham chief executive Miguel Morel told CoinDesk the attacker may have exploited EIP-7702, an Ethereum feature that lets a wallet hand control to contract code. A service container submitting withdrawals and a wallet delegating authority are different mechanisms, and Binance has not said how they connect, if they do. Readers should treat the laptop account as Binance's current working theory, not a closed finding, and watch the promised post-mortem for the missing link.

No private key leak, according to Binance

The second claim in the update is the one Binance most wants customers to hear: "We have found no evidence of any wallet private key leak." If that holds, the incident was a break-in through a staff machine and a service, not a theft of the keys that control Binance's wallets, which would change how the exchange rebuilds its defenses and how much of its wallet infrastructure must be replaced. It is, however, a negative finding at an early stage of an investigation, and Binance has published no technical evidence for it yet. The claim also sits alongside a fact that has not changed: the drained wallets were hot wallets, kept online to process withdrawals, and the transfers themselves are visible on-chain. Etherscan data cited by CoinDesk shows 167,464 ether moving from the wallet labeled Binance 14 at 20:24 UTC on October 29, followed by 28,005.6 ether from Binance 16, with 195,460 ether, worth around $442 million, forwarded to a second address about 15 minutes later. The on-chain record proves money moved. It does not prove how the attacker got in, and only Binance's post-mortem can close that gap.

The $6.3 billion figure and the $3 billion frozen

Binance's $6.3 billion estimate lands close to the largest outside estimate, which narrows a range that had stretched from about $2.5 billion to nearly $6 billion in the first hours. Chainalysis estimated about $5.912 billion was stolen, according to CoinDesk's live updates, and CoinDesk cited Arkham data putting the hacker's wallet holdings above $5.7 billion. Binance's own figure is now the number to quote first, with the outside estimates kept as cross-checks, but it is still an estimate, not an audited accounting, and Binance has not broken it down by chain or asset. Against it stands the verified frozen total of around $3 billion, which Binance repeated in this update, up from $2.54 billion in its earlier statement. Most of that comes from stablecoin issuers: Tether chief executive Paolo Ardoino said Tether froze more than $1.567 billion in USDT, and Circle chief executive Jeremy Allaire said Circle froze more than $800 million in USDC, together more than $2.37 billion. CoinTelegraph's live updates add that First Digital confirmed it has frozen FDUSD involved in the attack. A freeze stops whoever controls a frozen address from moving those stablecoins, but it does not by itself return assets to Binance or its customers, and it does not freeze ether or bitcoin at the same address. The gap between $6.3 billion and $3 billion, roughly $3.3 billion, is the amount still unfrozen, unrecovered, or already moved beyond reach, and it is the number that will decide how much of the coverage pledge Binance must fund itself.

Who pays, and what happens to reserves

Binance repeated its funding plan in this update, with one new detail: "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe." The SAFU fund, the Secure Asset Fund for Users, holds around $1 billion in bitcoin, CoinDesk reports, so it cannot by itself cover a $6.3 billion impact even before counting the $3 billion already frozen. The company's own funds must carry the rest, and Binance has not said how much of either source it will use, or on what timetable customers would be made whole. Co-chief executive Yi He separately said withdrawals will resume as soon as the security scan is complete, according to Bitcoin.com, but Binance has given no date, and all deposits and withdrawals remain suspended as of this article. The most consequential promise for trust may be the one about reserves: Binance said it will publish updated proof-of-reserves figures after remediation, PANews and TokenPost report. That matters because CoinDesk's review of Binance's own October 1 proof-of-reserves data found that the drained wallet, Binance 14, appears in that report, holding 1.26 billion USDT and 89,475 ether among 37 assets at the time. On October 1, Binance held exactly enough ether to cover customer balances, a 100 percent reserve ratio, and 108.26 percent of customers' USDC, CoinDesk reports. The roughly 204,500 ether taken represents about 5.6 percent of Binance's ether reserves, leaving ether backing near 94 percent, with USDC and several altcoins also likely below 100 percent, and smaller positions including ENA, UNI, PEPE and AAVE representing anywhere from 7 to 15 percent of Binance's reported holdings of each. In plain terms, some of the assets that backed customer balances are gone, and Binance's own pledge, not the reserve snapshot, is what currently stands behind those balances. The November 1 snapshot will show whether Binance has replaced what was taken before it publishes, and whether the updated figures it promised arrive before or after that date.

The market reaction

Markets fell as the scale of the incident became clear, and the prices reported by Reuters give the shape of it. Bitcoin dropped to a six-week low of $77,646, ether fell to a two-month low of $2,238.76, and BNB, Binance's native token, was down more than 8 percent over 24 hours at $694, according to CoinGecko data cited by Reuters. Those are snapshots from early Asian trading on October 30, not a verdict on Binance's solvency, and prices often move again as verified facts arrive. What has not moved is the exchange's own position on reopening: deposits and withdrawals stay suspended, Binance Alpha trading stays paused, and the only timetable Binance has offered is Yi He's statement that withdrawals resume when the security scan is complete. For customers, the practical position is unchanged from MABOnChain's previous article: funds held on the exchange cannot be moved in or out until Binance reopens transfers, and any message offering to unlock withdrawals for a fee or to verify an account through an unofficial link should be treated as a scam.

What to watch next

The next verified facts to look for are the detailed technical post-mortem, the updated proof-of-reserves figures, a Binance announcement reopening deposits and withdrawals, and any statement from law enforcement on attribution. Binance said it is working closely with law enforcement partners to confirm the identity of the criminals and bring them to justice, and with blockchain intelligence partners to trace and recover funds. Until the post-mortem arrives, the confirmed position is this: Binance's initial investigation points to a compromised DevOps engineer's laptop and a service container as the route in, with no evidence found of a private key leak; the estimated impact is around $6.3 billion, with about $3 billion frozen on-chain; Binance pledges to cover all losses from its SAFU fund and company funds; all deposits and withdrawals remain suspended with no reopening date; and the drained wallets were part of the assets Binance listed as backing customer balances in its October 1 proof of reserves, leaving ether backing near 94 percent until Binance replaces what was taken.

This article is news reporting and is not investment advice.

Sources

• Binance, statement on X, October 30, 2026, primary source for the compromised DevOps engineer's laptop, the service container access, the unauthorized withdrawal transactions, the finding of no evidence of a wallet private key leak, the estimated total impact of around $6.3 billion, the roughly $3 billion frozen on-chain, the coverage of all losses from the SAFU fund and company funds, the revoked address authorization, the law enforcement and blockchain intelligence work, and the promised detailed technical post-mortem, as reported by PANews, TokenPost, Bitcoin.com, BeInCrypto and TechNode below
• PANews, Binance: Security Incident May Involve Compromised Laptop of a DevOps Engineer, No Private Key Leak Found, Total Losses Estimated at About $6.3 Billion (published October 30, 2026, 02:25 UTC), secondary reporting of the Binance statement, including the promised updated proof of reserves after remediation
• TokenPost, Binance Points to Engineer's Laptop in Incident With $6.3 Billion Estimated Loss (published October 30, 2026, 03:14 UTC), secondary reporting of the Binance statement and the updated proof-of-reserves promise
• Bitcoin.com, Binance Releases First $6.3B Hack Findings, Reports No Key Leak Evidence (published October 29, 2026, 11:08 PM EDT), secondary reporting of the Binance statement and of Yi He's statement that withdrawals resume as soon as the security scan is complete
• BeInCrypto, Binance Hack: $2 Billion Drained, Circle and Tether Freeze, Crypto Markets React (updated October 30, 2026), secondary reporting of the Binance statement and the $3 billion frozen total
• TechNode, Binance vows to cover all losses from security breach, estimated at $6.3B (published October 30, 2026, 02:52 UTC), secondary reporting of the Binance statement, the continued suspension of deposits and withdrawals, and the SAFU and company funds coverage
• CoinDesk, Binance says customer money is safe after huge hack drains key reserve wallets (published October 29, 2026, 8:17 PM EDT), secondary source for the proof-of-reserves analysis: Binance 14 in the October 1 report, its 1.26 billion USDT and 89,475 ether holdings, the 100 percent ether and 108.26 percent USDC ratios, the roughly 204,500 ether taken, the near 94 percent ether backing, the Etherscan transfer figures, and the SAFU fund's roughly $1 billion in bitcoin
• CoinDesk live updates, Live Updates: Binance hit by largest crypto hack in history (updated October 30, 2026), secondary source for the Chainalysis $5.912 billion stolen estimate and the First Digital FDUSD freeze
• Reuters, Bitcoin, cryptocurrency prices fall after Binance reports security issue (published October 30, 2026, 00:38 UTC), secondary source for bitcoin's six-week low of $77,646, ether's two-month low of $2,238.76, and BNB down more than 8 percent at $694, per CoinGecko
• MABOnChain, Binance Pledges to Cover All Hack Losses, Suspends All Deposits and Withdrawals (October 30, 2026), context for the earlier coverage pledge and full suspension, and for the earlier position that Binance had published no loss figure
• MABOnChain, Binance Investigates Suspected Multi-Billion Hack as Tether, Circle Freeze Funds (October 30, 2026), context for the first investigation, the Tether and Circle freezes, and the EIP-7702 hypothesis reported by outside researchers