Security Checks from Real IncidentsInspect with AI
← Incident database

Binance: ~$6.3B cryptocurrency outflow via compromised DevOps engineer laptop

binance-breach-2026 · Disclosed 2026-10-29

Binance reported that an attacker compromised a DevOps engineer's laptop, gained access to a service container, and executed unauthorized withdrawal transactions. Approximately $6.3 billion in cryptocurrency was affected, with ~$3 billion frozen on-chain. No evidence of wallet private key leakage was found, and Binance committed to covering all losses from its SAFU fund and company funds.

Implementation

Outcome: Confirmed breach

Entry path and evidence

  • Reported fact

    Initial investigation suggests a compromised DevOps engineer's laptop allowed the attacker to access a service container and submit unauthorized withdrawal transactions. No evidence of wallet private key leakage was found.

    [s1][s2]Security Incident Update / Initial investigation suggests
  • Reported fact

    The estimated total impact is around $6.3 billion. Approximately $3 billion in affected assets were frozen on-chain through collaboration with blockchain partners.

    [s1][s2]estimated total impact
  • Reported fact

    As of November 1, Binance reported replenishing about 95% of the stolen assets using company funds. All losses will be covered by the SAFU fund and company funds without passing losses to users.

    [s3][s4]95% replacement / cover all losses

Timeline

  1. Announced security incident. Temporarily suspended withdrawals and began investigation. [s1]

  2. Began phased withdrawal resumption starting with Bitcoin and major assets. Announced ~95% asset replacement. [s3] [s4]

Reported response

  • Reported fact

    As an immediate precaution, withdrawals were temporarily suspended and affected address authorization was revoked. Engaged law enforcement and blockchain intelligence partners to trace and recover funds.

    [s1]immediate precaution
  • Reported fact

    Committed to covering all losses from the SAFU fund and company funds. Plans to publish an updated Proof of Reserves once remediation is complete.

    [s1]cover all losses from SAFU

Cause and mitigation hypotheses

Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.

Evidence relevant to prevention

Insufficient evidence

The compromise path into the DevOps environment and authentication/privilege controls at the time are unknown. A detailed technical post-mortem will be shared once the investigation is complete.

Editorial assessment; not a determination of liability. [s1]

Unknowns and AI involvement

AI involvementUnknown

The reviewed primary sources do not establish attacker use of AI.

Specific compromise path into the DevOps environment, CVEs used, and attacker identification remain unconfirmed. Detailed technical post-mortem will be shared once the investigation is complete.

Sources

  1. [s1] Binance · Primary source

    Security Incident Update (2026-10-30) ↗

    Published 2026-10-29 · Reviewed 2026-11-02

  2. [s2] 日経クロステック · Secondary

    Binanceで資金流出、影響額は推定1兆円規模　DevOpsエンジニアのPC侵害か ↗

    Published 2026-10-30 · Reviewed 2026-11-02

  3. [s3] 東洋経済オンライン · Secondary

    バイナンスが出金再開へ､流出したトークン63億ドルのうち95％を補填…FBIは北朝鮮の関与を指摘 ↗

    Published 2026-11-01 · Reviewed 2026-11-02

  4. [s4] CoinDesk · Secondary

    バイナンス、63億ドルのハッキングを受けビットコインから段階的に暗号資産の引き出しを再開 ↗

    Published 2026-11-01 · Reviewed 2026-11-02