Approximately $3 billion in affected assets have been frozen on-chain, while Binance has committed to covering all losses.
Binance said its preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer as the possible entry point for Friday’s security breach, which prompted the exchange to suspend deposits and withdrawals.
The attacker allegedly used the access to enter a service container and initiate unauthorized withdrawal transactions, although Binance found no evidence that wallet private keys were exposed, the exchange said in its latest update on X.
Binance estimated the incident’s impact at approximately $6.3 billion and said it had frozen about $3 billion in affected assets on-chain. The exchange has pledged to cover all losses through its SAFU fund and corporate resources.
Binance exploiter retains billions in crypto
The attacker behind the suspected Binance breach still holds approximately $3 billion in crypto across multiple blockchains, according to data tracked by Nansen.
Nansen identified around 442,000 ETH across exploiter-linked wallets, while tracking 18,270 BTC worth approximately $1.48 billion transferred from a Binance hot wallet and split among 19 separate addresses.
The attacker also reportedly moved about 233 million XRP worth about $297 million and used DeFi protocols to borrow ETH against USDT deposits and swap hundreds of millions of dollars in altcoins. Around $2.7 billion in assets has reportedly been frozen, but substantial holdings remain across Ethereum, Bitcoin, TRON and Solana.
Update (Oct. 30 2026): This article has been updated to include Nansen’s report.
