Binance says its October 30 attack was multi-stage, with $6.3 billion in preliminary damage

Binance has released new details on the attack against the exchange, and the key point for payment and crypto operators is that this was not a single-action breach or a simple employee-access incident. According to Richard Teng, the company’s preliminary findings point to a possible compromise of a DevOps engineer’s laptop, followed by unauthorized withdrawal transactions routed through a service container.

1. Teng, Binance’s senior executive and co-founder, said the incident involved several stages. The investigation has not yet established responsibility for any specific employee, which matters because the operational path appears to have been broader than a single compromised credential.
2. The preliminary results indicate that a DevOps engineer’s laptop may have been compromised. That access allegedly let the attacker reach a service container used to send unauthorized transactions for fund withdrawals.
3. Binance temporarily suspended withdrawals while it carried out a comprehensive security upgrade for the withdrawal service and the related addresses. Deposits continue to operate as usual, and the exchange also revoked authorizations for the affected addresses.
4. The preliminary total damage is estimated at about $6.3 billion. Around $3 billion has already been frozen directly on-chain through coordination with the company’s partners. Teng also said Binance will cover all user losses from the SAFU fund and its own resources.
5. Binance said it has not found any evidence of private key leakage from crypto wallets. After the investigation and fact-checking are completed, the company plans to publish a detailed technical incident report and update its Proof of Reserves data after the remediation work is finished.

For high-risk PSPs and crypto platforms, the operational takeaway is straightforward: withdrawal infrastructure, service containers, and endpoint security are all part of the same control surface. If one of them is weak, the incident stops being a “wallet problem” very quickly.