Binance Says Laptop Breach May Be Behind $6.3B Hack, Vows Full Cover

Binance said at 10:25 PM ET Thursday that a compromised engineer's laptop may be behind a security incident it now puts at about $6.3 billion.

That is the first named cause and the first total from the exchange itself. In an X post linking its announcement, Binance said the laptop "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It said it found "no evidence of any wallet private key leak" and has revoked the affected address authorisation.

At that size it would be the largest crypto theft on record, the South China Morning Post noted, ahead of the $1.5 billion taken from Bybit in February 2025, which the FBI tied to North Korea.

How it works: exchanges keep most coins in offline cold storage and a smaller pool in hot wallets that pay out withdrawals automatically. A service container is a walled-off piece of software on a server that does one job, such as sending payout requests. If Binance's early account holds, the attacker never needed the vault keys. Access to the system that asks for withdrawals was enough to move coins out.

Now the money. Binance said about $3 billion has been frozen on-chain with partners, which leaves roughly $3.3 billion not yet frozen by its own numbers. It said it "will cover all losses from the SAFU fund and the company's funds," that user funds are safe, and that it will publish an updated proof of reserves after the fix.

All deposits and withdrawals are suspended, wider than the partial pause earlier in the evening. Co-founder Yi He said at 10:32 PM withdrawals will reopen once a security scan finishes, with no time given. She also said the Arbitrum Security Council froze about $30.5 million, and Coinbase CEO Brian Armstrong said Coinbase is blocking sends to compromised wallets.

BNB traded at $717.66 at 11:58 PM ET, down 3.8% over 24 hours, and bitcoin at $78,008, down 2.2%, per CoinGecko.

In our opinion: A named cause and a written promise to pay are the two things customers needed tonight, and Binance has now put both on the record. The open question is the $3.3 billion that isn't frozen, which SAFU and company funds would have to fill. Watch for a restart time on withdrawals and the post-mortem, which should show whether one laptop really opened the door.