Binance says a security incident affected about $6.3 billion of assets, with roughly $3 billion frozen on-chain so far. The exchange says its preliminary investigation points to a compromised laptop used by a DevOps engineer as a possible entry point, but the full attack path is still being traced.
The company says it has found no evidence that wallet private keys were leaked and says customer assets were not affected. Binance has committed to absorb the losses through its Secure Asset Fund for Users and corporate resources.
| Question | Latest confirmed position |
|---|---|
| How much was affected? | Binance estimates the total impact at about $6.3 billion. |
| How much is frozen? | About $3 billion has been frozen on-chain, according to Binance. |
| Were private keys leaked? | Binance says it has found no evidence of a wallet private-key compromise. |
| Were customer funds hit? | Binance says the affected assets were in its own hot wallet and customer funds were not affected. |
| Are deposits working? | In a later service update, Binance said deposits were operating normally. |
| Are withdrawals working? | Crypto withdrawals remain paused while the withdrawal system and related addresses are rebuilt and checked. |
| Who bears the loss? | Binance says SAFU and company funds will cover the incident. |
| What comes next? | Withdrawal reopening, an updated Proof of Reserves, a technical post-mortem and further asset-recovery updates. |
What Binance says happened
Binance's official security update says the preliminary investigation suggests a compromised DevOps engineer's laptop may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Binance cautions that the investigation is continuing and says it will publish a detailed technical post-mortem after the facts are fully verified.
That distinction matters. A compromised employee device is Binance's current working explanation for an entry point, not yet a complete account of how the attacker moved through the environment or why the controls around the withdrawal process did not stop the transactions earlier.
About $3 billion is frozen — but the final recovery is not known
Binance says it coordinated with blockchain partners to freeze approximately $3 billion of the affected assets on-chain. That figure should not be treated as the same thing as the final recovered amount: tracing and recovery are still under way, and the company has not yet published a final irrecoverable-loss figure.
The exchange says it is working with law-enforcement agencies and blockchain-intelligence partners while revoking authorization for affected addresses. Binance has not publicly identified the attacker in its official incident notice, so attribution remains unresolved.
Deposits are back, while withdrawals remain paused
An official Binance service update says deposits are no longer affected and are operating normally, while crypto withdrawals remain paused as the exchange rebuilds and checks its withdrawal service and related addresses. Binance said it expected withdrawals to resume within 48 hours, although that remains a target rather than a guaranteed reopening time.
For markets, reopening is the next important operational test. A routine resumption would support Binance's argument that the breach can be contained as a company-level security and balance-sheet event. Persistent withdrawal pressure after reopening would make the incident more relevant to broader crypto liquidity and confidence.
Binance says it can fund the loss without using customer assets
Binance CEO Richard Teng said in an official update that the exchange has reserved more than $6.34 billion to cover the incident and already holds about $5 billion in the same token types that were affected. He said Binance is sourcing the remaining amount through market and over-the-counter channels.
That reduces one immediate uncertainty — whether the exchange says it has sufficient resources to make the loss whole — but it does not eliminate the market questions. Investors will still watch whether any token purchases create visible spot-market pressure, how quickly frozen assets are recovered, and whether the updated Proof of Reserves changes perceptions of Binance's post-incident balance sheet.
What remains unknown
Four issues are still open: the complete attack chain, the identity of the attacker, the final amount that can be recovered, and the exact time at which withdrawals resume. Binance has also promised an updated Proof of Reserves and a technical post-mortem. Those documents will matter more than early speculation because they should show whether the breach was confined to one operational path or exposed a broader control weakness.
Until then, the most useful distinction is between the headline amount and the realized economic loss. Binance's current estimate is about $6.3 billion affected; roughly $3 billion is frozen on-chain; the company says it will absorb the balance; and the final recovery figure is still moving.