On October 29, 2026, Binance reported a security incident and put its preliminary overall impact at about $6.3 billion. The more-than-$5.7-billion figure in reports referred to the value of assets held in wallets linked to the suspected attacker, not a final tally of irrecoverable losses. Binance also said roughly $3 billion in assets had been frozen; the cause was still under investigation.
What happened at Binance on October 29, 2026?
Binance reported a potential security incident affecting a large volume of crypto assets and began investigating.
Reports published on October 29 cited more than one estimate. Binance later put the incident’s preliminary overall impact at about $6.3 billion. That company estimate does not mean the entire amount was a final, unrecoverable loss.
It is important to distinguish the reported incident, preliminary estimates, and the findings of a completed investigation. Early reports had not established the full attack mechanism or final financial impact.
Why do reports cite both $5.7 billion and $6.3 billion?
The figures describe different measures: Binance’s preliminary estimate of about $6.3 billion in overall impact and CoinDesk’s report of more than $5.7 billion in assets held in wallets linked to the suspected attacker.
CoinDesk reported that wallets linked to the suspected attacker held assets worth more than $5.7 billion at one point. The same report discussed other estimates of the assets stolen. The headline claim that Binance “lost $5.7 billion” therefore compresses several different measures: assets tracked in wallets, the exchange’s estimate of overall impact, and any eventual confirmed losses.
When comparing incident figures, check what each number measures: asset movements, the exchange’s own estimate, balances in specific wallets, or confirmed losses.
What is known about the possible attack vector?
Binance’s preliminary account pointed to a potentially compromised DevOps engineer’s laptop, but that account is not a final investigative finding.
In its preliminary account, Binance said a compromised device may have enabled access to a service container and the submission of unauthorized withdrawal transactions. The exchange also said it had found no evidence that wallet private keys were leaked.
These are early findings reported by the company, not independent confirmation of the complete technical sequence. While the investigation continues, neither a specific vulnerability nor an attacker’s identity should be presented as conclusively established.
What response did Binance report, and what can platform operators learn?
Binance said roughly $3 billion in assets had been frozen and said it would cover incident-related losses using SAFU and company funds.
Binance reported that roughly $3 billion had been frozen on-chain. The exchange also said deposits were no longer affected and that it would cover losses related to the incident using SAFU and company funds. These are the exchange’s statements, not an independent assessment of a completed recovery.
For crypto trading-platform operators and developers, the incident is a reminder to review layered controls. Practical areas include employee access boundaries, endpoint security, approval and monitoring of critical withdrawals, anomaly detection, and incident-response plans. These are general risk-management considerations; they do not establish that any particular missing control caused this incident.
FAQ
Is it confirmed that Binance irretrievably lost $5.7 billion?
No. CoinDesk used that figure for the value of assets in linked wallets. Binance separately put the preliminary overall impact at about $6.3 billion; neither figure should be treated as a final tally of irrecoverable losses.
How much was reportedly frozen?
Binance reported that about $3 billion in assets had been frozen on-chain. The figure reflects the update available at the time and could change.
Were wallet private keys leaked?
Binance said it had found no evidence of a wallet private-key leak. That was a report of preliminary findings, not independent confirmation of every investigative detail.
Has the attacker been identified?
The sources available for this article do not establish a definitive attribution. Early suggestions about a specific group should not be treated as confirmed.