Binance Links $6.3B Hack to Engineer’s Compromised Laptop
Ecosystem
English
News
Latest News
- Bitcoin
- Ethereum
- Altcoins
- Blockchain
- Regulation
- Markets
- Features
- Magazine
- Reviews
- Research
- Opinion
- Podcasts
- Newsletters
- Commissioned Articles
- Press Releases
- Special Projects
About
About Cointelegraph
- History of Cointelegraph
- Editorial Policy
- Ads Disclosure
- Financial Risk Disclaimer
Crypto Market Data (at the time of writing):
- DOGE: $0.07545 (1.37%)
- TRX: $0.3249 (3.49%)
- LINK: $11.45 (3.00%)
- ZEC: $1,265.54 (0.60%)
- ADA: $0.1933 (0.53%)
- XRP: $1.24 (1.66%)
- ETH: $2,242.57 (0.26%)
- BTC: $77,229.55 (1.69%)
- XMR: $596.63 (1.17%)
- BNB: $703.15 (1.81%)
- XLM: $0.1690 (1.11%)
- SOL: $95.89 (2.29%)
- HYPE: $88.18 (5.80%)
Written by:
- Felix Ng (staff editor)
- Bryan O'Shea (staff editor)
Binance Points to Compromised Laptop in $6.3B Breach
Latest News
Published: Oct 30, 2026
Binance revealed that attackers may have exploited a compromised DevOps engineer's laptop to gain access to its internal infrastructure, resulting in a multi-billion dollar breach.
Update (Oct. 30 at 2:44 am UTC): This article has been updated with Binance's preliminary investigation findings.
Binance suspects that the laptop compromise enabled unauthorized access to a service container, allowing for the submission of fraudulent withdrawal transactions. However, they have found no evidence of a wallet private key leak during their ongoing investigation.
Blockaid CEO Ido Ben-Natan, in a conversation with Cointelegraph on Thursday, also pointed to "key misuse" where attackers tricked or compromised a signing system to authorize malicious transactions without acquiring the underlying private key.
Estimates and Impact:
- Binance estimates the total impact at approximately $6.3 billion.
- They have frozen around $3 billion of stolen assets on-chain.
- The exchange will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds.
- A detailed technical post-mortem will be published once the investigation is complete.
Response and Measures:
- Binance temporarily suspended deposits and withdrawals while conducting security checks.
- They revoked the authorization of the affected address.
- Law enforcement and blockchain intelligence partners are being engaged to trace and recover funds.
Similar Attacks?
Ben-Natan compared this incident to the February 2025 Bybit attack, suggesting possible similarities in the manipulation of signing infrastructure. However, Arkham CEO Miguel Morel previously expressed uncertainty, stating that insufficient information was available to determine the attack vector.