Binance confirmed a security incident on Oct 29 after billions in crypto moved from several of its hot wallets to new attacker addresses. In its latest update (about 10:25 PM ET), Binance said its initial investigation suggests the attacker compromised a DevOps engineer's laptop, used it to reach a service container, and from there submitted unauthorized withdrawal transactions. It says it has found no evidence of a wallet private key leak.

• Size: Binance puts the estimated total impact at around $6.3B, with about $3B frozen on-chain with help from stablecoin issuers and blockchain partners. If the figure holds it would be the largest crypto theft on record, well above the $1.5B Bybit theft in February 2025. Per BleepingComputer, Tether froze more than $1.567B in USDT and Circle more than $800M in USDC; Binance co-founder Yi He said the Arbitrum Security Council froze about $30.5M.
• Response: deposits and withdrawals are suspended while security checks run; Binance says it revoked the affected address authorization, is working with law enforcement, and will cover all losses from its SAFU fund and company funds. It promises a technical post-mortem and an updated proof of reserves.
• Not known yet: who is behind it, how the laptop was compromised, and why one service container could sign or submit withdrawals of this size.

Why it matters beyond crypto: if confirmed, this is a single engineer endpoint leading to a production service with authority to move money. Check which of your workloads can perform irreversible high-value actions, whether an engineer's workstation can reach them, and whether those actions need a second, independent approval or rate limit. Scam warning: expect fake "Binance refund" and "withdrawal verification" phishing; Binance says to use only its official channels.