---
title: Binance says an attacker who compromised a DevOps engineer's laptop pushed unauthorized withdrawals from its hot wallets; estimated impact about $6.3 billion, with about $3 billion frozen so far | ctxsec
url: https://ctxsec.com/items/binance-hot-wallet-theft-devops-laptop-6-3b-impact
description: ""
status: "official (Binance statements on X, Oct 29-30); cause is Binance's initial finding and may change; no attribution yet; full post-mortem promised"
published: 2026-10-29
---

> 

[← Cybersecurity News](/news) · [markdown](/items/binance-hot-wallet-theft-devops-laptop-6-3b-impact.md)

official (Binance statements on X, Oct 29-30); cause is Binance's initial finding and may change; no attribution yet; full post-mortem promised

2026-10-29

### Binance says an attacker who compromised a DevOps engineer's laptop pushed unauthorized withdrawals from its hot wallets; estimated impact about $6.3 billion, with about $3 billion frozen so far

Binance confirmed a security incident on Oct 29 after billions in crypto moved from several of its hot wallets to new attacker addresses. In its latest update (about 10:25 PM ET), Binance said its **initial investigation** suggests the attacker compromised a **DevOps engineer's laptop**, used it to reach a **service container**, and from there submitted unauthorized withdrawal transactions. It says it has found **no evidence of a wallet private key leak**.

- **Size:** Binance puts the estimated total impact at **around $6.3B**, with **about $3B frozen on-chain** with help from stablecoin issuers and blockchain partners. If the figure holds it would be the largest crypto theft on record, well above the $1.5B Bybit theft in February 2025. Per BleepingComputer, Tether froze more than $1.567B in USDT and Circle more than $800M in USDC; Binance co-founder Yi He said the Arbitrum Security Council froze about $30.5M.
- **Response:** deposits and withdrawals are suspended while security checks run; Binance says it revoked the affected address authorization, is working with law enforcement, and will cover all losses from its SAFU fund and company funds. It promises a technical post-mortem and an updated proof of reserves.
- **Not known yet:** who is behind it, how the laptop was compromised, and why one service container could sign or submit withdrawals of this size.

**Why it matters beyond crypto:** if confirmed, this is a single engineer endpoint leading to a production service with authority to move money. Check which of your workloads can perform irreversible high-value actions, whether an engineer's workstation can reach them, and whether those actions need a second, independent approval or rate limit. **Scam warning:** expect fake "Binance refund" and "withdrawal verification" phishing; Binance says to use only its official channels.

Sources: [Binance on X: initial investigation points to a compromised DevOps engineer laptop; estimated impact ~$6.3B, ~$3B frozen (Oct 30, 02:25 UTC)](https://x.com/binance/status/2115993361517891592) · [Binance announcement linked from that post](https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7) · [Binance on X: deposits and withdrawals suspended; Binance will cover all losses (Oct 30, 00:13 UTC)](https://x.com/binance/status/2115960292115124558) · [BleepingComputer: Binance probes potential $5.8 billion crypto-theft hack (Oct 29)](https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/)