Binance says its $6.3B hack went beyond a compromised DevOps laptop; it will cover all losses and about $3B is frozen

Teaser from the source

On Oct 29 2026 at about 20:24 UTC, more than $2B in ETH and tokens left Binance hot wallets (labeled Binance 14 and Binance 16 on Etherscan) for an address created that day, according to Etherscan data reported by BeInCrypto. The transfer was triggered by a wallet funded only through Tornado Cash, and the receiving address quickly forwarded about 195,460 ETH (around $450M) to another fresh address. Binance says it is aware of reports of a potential security issue, is actively investigating and that user funds are completely safe; it has not confirmed a breach or a loss total. Founder CZ, who no longer runs Binance, said it does look like a hack and that he expects all user funds to be fully covered. Tether CEO Paolo Ardoino said Tether froze more than 1.567B USDT tied to a potential Binance exchange hack, and Circle CEO Jeremy Allaire said Circle froze more than 800M USDC in coordination with law enforcement; Binance co-founder Yi He later thanked Ripple for freezing about 200 million more. Blockaid says the attacker used an EIP-7702 authorization to turn the Binance 14 hot wallet into a sweeper contract only the attacker can drain. Binance later paused withdrawals, saying they will resume once the security issue is fully resolved, and CZ said the loss might be a bit higher than the roughly $1B left after freezes but will be covered. World Liberty Financial froze $27M in USD1 linked to the hack. Binance.US says it is a separate platform and is not affected. If confirmed, it would be the largest exchange hack on record. Binance then said the current verified total frozen is $2.54 billion and suspended Binance Alpha trading, and co-founder Yi He said Binance will cover all hacking losses, that deposits and withdrawals are temporarily suspended during security checks, and that a full post-mortem will follow; Binance's official account repeated that Binance will cover all losses and that all deposits and withdrawals are suspended. The Arbitrum Security Council moved 74,559,805 ARB and 8,425 ETH held by an exploit-linked Arbitrum One address into a frozen wallet. Binance later updated its verified total frozen to around $3 billion. Chainalysis estimates about $5.912B was stolen at the time of theft, nearly four times the 2025 Bybit heist, which would make it the largest crypto theft on record. Binance then gave its first official figures: its initial investigation suggests a compromised DevOps engineer's laptop let the attacker reach a service container and submit unauthorized withdrawal transactions, it has found no evidence of a wallet private key leak, the estimated total impact is around $6.3B with about $3B frozen on-chain, and it will cover all losses from the SAFU fund and company funds. It says it revoked the affected address authorisation and will publish a technical post-mortem and an updated Proof of Reserves. Yi He later said deposits are unaffected and operating as normal and that Binance expects to begin resuming withdrawals within the next 48 hours after enhancing the withdrawal service and address controls. Binance then said that while its initial investigation suggested a compromised laptop, its subsequent investigation has uncovered additional points of breach, calling it a complex attack. Co-CEO Richard Teng later said in a video update that the attacker used a self-destruct mechanism to erase traces and an EIP-7702 delegation that bypassed Binance's normal approval controls, that Binance has reserved more than $6.34B of company funds to cover all losses, and that it aims to restore withdrawals by Sunday, with an initial proof-of-reserves update before a full report on Monday. Binance users have nothing to patch: watch for official updates only through Binance's own channels and ignore unofficial links or requests for account details, which Binance warns are circulating.

This is the RSS-feed teaser. Read the full article at the original source.