Binance Expands Inquiry Into $6.3 Billion Breach
Binance said its investigation into a breach it estimates at around $6.3 billion has uncovered additional points of compromise beyond the initially identified laptop of a DevOps engineer. The exchange has frozen about $3 billion onchain with assistance from blockchain partners, according to Decrypt.
The findings add complexity to an incident that Binance CEO Richard Teng said was not the result of a single action. Withdrawals remain suspended, while Binance has said deposits were unaffected and that it will cover losses, NPR reported.
What happened
Binance initially indicated that the incident may have involved a compromised DevOps engineer’s laptop. Its subsequent inquiry found further points of breach, according to Decrypt and NPR, indicating that the exchange’s assessment of the intrusion expanded after the first public explanation.
Teng said the attack was not a single “one-click” action, Decrypt reported. Cointelegraph likewise reported that Teng described a more complex process than an attacker simply using one engineer’s permissions.
Cointelegraph reported that Teng said the attacker used a self-destruct mechanism to remove tools and traces. The outlet also reported that the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet without going through normal approval controls.
Binance has said it found no evidence that wallet private keys were leaked, according to NPR. The company said it would release additional technical details after its investigation is complete.
The exchange said about $3 billion had been frozen onchain with the help of blockchain partners, Decrypt reported. That figure sits alongside Binance’s estimate that the total impact was around $6.3 billion. The amount frozen has changed across updates, with reported figures moving from $2.54 billion to $2.80 billion and then $3 billion.
Why it matters
The incident has put attention on the security controls surrounding exchange hot wallets, which are used to facilitate operational transfers and withdrawals. Binance is the world’s largest cryptocurrency trading platform by volume, NBC News reported, so a prolonged interruption or incomplete account of the breach could have wider significance for users and the exchange sector.
Binance said deposits were unaffected, NPR reported. Withdrawals, however, were suspended as the company reviewed the incident. In its earlier statement, reported by NBC News, Binance said its teams were examining a potential security issue urgently and urged users to remain cautious of scams.
The company’s commitment to cover losses is also central to the response. NPR reported that Binance said it would cover all losses, while Cointelegraph reported that Binance had set aside more than $6.34 billion in company funds, including $5 billion held in the affected tokens and the remainder obtained through market and over-the-counter deals.
The variation between the $6.3 billion incident estimate and the more than $6.34 billion reserve figure should not be treated as a direct comparison of theft and recoveries. Binance has described one as the estimated impact and the other as funds set aside to cover losses, based on the reporting from Decrypt and Cointelegraph.
Background and context
The breach affected Binance hot wallets and has been described as a record $6.3 billion theft. Binance has said it will cover losses through its SAFU emergency fund and company funds, and plans to publish an updated Proof of Reserves after remediation is complete.
Estimates of the amount taken differ. Binance has put the impact at $6.3 billion, while Chainalysis estimated $5.912 billion stolen and Arkham estimated $6.01 billion. Chainalysis’s estimate was described as four times the amount stolen from Bybit in 2025.
These differences underscore that the total scale of the event remains subject to ongoing analysis. The reported frozen amount has also shifted during the response, and a frozen onchain balance does not by itself establish a final recovery outcome.
Binance’s response has focused on restoration, investigation and disclosures. CoinDesk reported that Teng said Binance hoped to resume withdrawals by Sunday, within approximately 40 hours, and publish a full proof-of-reserves report by Monday. Other updates have put withdrawal restart guidance at 45 hours or 48 hours, so the expected timing has not been consistent across reports.
What to watch
The key outstanding issue is Binance’s promised technical account of how the additional points of breach were accessed and how they relate to the compromised laptop initially identified by the company. Binance’s assertion that no wallet private keys leaked will also be an important part of that eventual explanation.
Users will be watching for a confirmed withdrawal restart schedule. NPR reported that Binance said withdrawals were expected to resume in the next day or two, while CoinDesk reported Teng’s Sunday target of approximately 40 hours. Binance has not yet provided a single timetable that resolves the differing guidance.
Other open questions include whether the amount frozen can be recovered, whether Binance’s final loss assessment changes, and what the promised Proof of Reserves report shows after remediation. The exchange’s fuller report may also clarify the role of the reported EIP-7702 delegation and the alleged self-destruct mechanism described by Cointelegraph.
