Binance $6.3B Hack Linked to Compromised Engineer Laptop

Binance said its preliminary investigation into the exchange’s estimated $6.3 billion security breach points to a compromised DevOps engineer’s laptop. The exchange said the device may have given an attacker access to a service container capable of submitting unauthorized withdrawal transactions. Binance has not found evidence that a wallet private key was exposed.

The exchange said it has frozen approximately $3 billion in affected on-chain assets with help from blockchain partners. Binance plans to cover all losses through its Secure Asset Fund for Users (SAFU) and company funds, temporarily suspended deposits and withdrawals, and revoked authorization for the affected address. It also pledged to publish an updated Proof of Reserves and a detailed technical post-mortem following the investigation.

Blockaid’s on-chain analysis found that the attacker bundled 50 EIP-7702 authorizations into one transaction targeting Binance 14. One authorization matched the account’s required nonce, allowing it to be accepted and effectively delegating the account to an unverified sweeper contract controlled by a designated operator. The setup allowed the attacker to drain tokens and Ether without extracting the original private key.

Blockaid’s Ben-Natan told Cointelegraph the operation appeared to involve compromised signing infrastructure, or “key misuse,” rather than a conventional private-key leak. He said multiple compromised devices may have been used to move through Binance’s internal network. The investigation remains ongoing as Binance works with law enforcement and blockchain intelligence partners to trace and recover the stolen funds.