Binance says a compromised laptop used by one of its DevOps engineers may have helped attackers reach internal infrastructure and submit unauthorized withdrawal transactions in a breach the exchange estimates affected about $6.3 billion in assets. The company said user funds remain safe and that no wallet private-key leak has been identified, although its investigation is still underway.
According to Cointelegraph, Binance’s preliminary investigation indicates that the attackers may have moved from the laptop into a service container connected to the exchange’s systems. The suspected access was then used to interfere with signing infrastructure and authorize withdrawals.
The exchange has not identified the attackers. It has revoked the affected address authorization, temporarily suspended deposits and withdrawals during security checks, and is working with law enforcement and blockchain intelligence companies to trace and recover assets.
Binance estimates losses at $6.3 billion
Binance put the estimated total impact of the breach at approximately $6.3 billion. It said blockchain partners had helped freeze around $3 billion of the affected assets onchain, referring to activity recorded on public blockchains.
The exchange said it would cover all losses through its Secure Asset Fund for Users, known as SAFU, together with company funds. Binance also said that user funds were safe and promised to issue an updated Proof of Reserves. Such reports are intended to show the assets held by a crypto platform against customer liabilities, although the specific updated report has not yet been published.
Binance said it would release a detailed technical post-mortem after its investigation is complete and the relevant facts have been verified. Until then, the precise route used by the attackers and the full breakdown of affected assets remain under review.
Suspected signing-system manipulation
The initial findings do not point to the theft of a wallet’s underlying private key. Instead, the suspected method involves misuse of the system that authorizes transactions.
Ben-Natan of blockchain security firm Blockaid told Cointelegraph that Blockaid’s preliminary assessment pointed to “key misuse.” In this type of incident, an attacker compromises or deceives a signing system into approving a malicious transaction without necessarily extracting the private key itself. His view was based on Blockaid’s experience with similar attacks and its observations of the related onchain activity.
Blockaid’s analysis said the attacker bundled 50 EIP-7702 authorizations into one transaction targeting “Binance 14.” One authorization reportedly matched the account’s required nonce, a transaction-ordering value used to determine whether an authorization can be accepted.
EIP-7702 allows a cryptocurrency account to delegate transaction execution to smart-contract code. Blockaid said the affected account had been delegated to an unverified “sweeper” contract. According to the analysis, that contract enabled a designated operator to drain tokens and Ether from the account.
Ben-Natan said the operation may have involved more than one compromised device and movement through Binance’s network. Before Binance issued its latest update, Arkham CEO Miguel Morel said there was not enough information to determine whether stolen keys or compromised infrastructure were involved. He also said the attack appeared to be ongoing at that stage.
Comparison with Bybit, but no confirmed attribution
Ben-Natan described the suspected signing manipulation as very similar to the February 2025 attack on Bybit. In Bybit’s published forensic account, attackers compromised credentials belonging to a Safe developer, gained access to the wallet provider’s infrastructure and induced signers to approve a malicious transaction.
He also said the Binance activity showed similarities to operations associated with North Korea, citing Blockaid’s experience tracking such attacks and the sophisticated preparation visible onchain. However, he stressed that this was not a confirmed attribution. Binance has not named any suspects and said it is cooperating with law enforcement to establish who was responsible.
The incident highlights the difference between protecting private keys and protecting the broader systems that use them. Even when a key is not directly exposed, a compromised device, service or approval workflow can potentially be used to authorize an improper transfer. Binance’s planned post-mortem is expected to provide more detail once the investigation is finished.
Current market picture
Moneyiar market data recorded at 10:39 p.m. local time on Oct. 25, 2026, shows BNB at $740.8618136891, up 0.81% over 24 hours and 3.32% over seven days. The figures below are also Moneyiar data from the same time window:
- Aptos (APT): $0.7037841724, down 0.81% in 24 hours and 7.92% over seven days.
- Compound (COMP): $21.1287447338, down 10.42% in 24 hours and up 0.3% over seven days.
- ECOMI (OMI): $0.0002733136, up 2.12% in 24 hours and down 0.94% over seven days.
These prices and percentage changes are a market snapshot and do not establish how the breach affected any particular token.
