Binance points to compromised DevOps laptop in $6.3 billion security incident

What Binance says happened

According to Binance, the attacker used that access to enter a service container and start unauthorized withdrawal transactions. It's a narrow description. The exchange calls its findings an initial investigation, and it says the incident "may" involve the laptop (it doesn't say the laptop was definitely the cause).

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.

The Crypto Briefing report doesn't say how the laptop was compromised or who was behind the attack.

A $6.3 billion estimate, $3 billion frozen

Binance estimated the incident's impact at approximately $6.3 billion in its latest update on X. The exchange said it had frozen about $3 billion in affected assets on-chain, which works out to a little under half of that estimate. Both numbers come from Binance itself.

LeoDex News couldn't independently verify either figure.

Binance also said it found no evidence that wallet private keys were exposed. That's the exchange's own assessment, and it isn't independently confirmed in the reporting so far.

SAFU pledge and suspended withdrawals

Binance pledged to cover all losses through its SAFU fund and corporate resources. Deposits and withdrawals were suspended after the breach, and the pledge is, again, Binance's own statement rather than something outside parties have checked.

For now, the laptop explanation is a working theory from Binance's preliminary review. It isn't an established finding, and the exchange's own language (initial, may, suggests) keeps it that way until it says more.