Cryptocurrency exchange Binance has confirmed that an initial investigation into its reported $6.3 billion security incident points to a potentially compromised DevOps engineer’s laptop as the entry point for the attack.
According to the company, the attacker allegedly gained access to a service container through the compromised device and used it to submit unauthorised withdrawal transactions.
Binance said its investigation has found no evidence that any wallet private keys were exposed or leaked.
The exchange estimates the total financial impact at approximately $6.3 billion. However, it has already worked with blockchain partners to freeze around $3 billion worth of the affected assets on-chain.
In a statement, Binance assured customers that all losses would be covered through its Secure Asset Fund for Users (SAFU) and the company’s own financial resources, insisting that user funds remain safe.
As part of its immediate response, the exchange temporarily suspended deposits and withdrawals while carrying out additional security checks. It also revoked the affected address authorisation and contacted law enforcement agencies and blockchain intelligence firms to trace and recover the stolen funds.
Binance said its security and investigation teams are working continuously with law enforcement partners to identify those responsible and pursue legal action.
The company also announced plans to release an updated Proof of Reserves report once the remediation process is completed.
Binance added that it would publish a comprehensive technical post-mortem after its investigation is concluded and all the facts have been verified.
