Binance said overnight from Thursday to Friday, October 30, that its preliminary investigation points to a compromised DevOps engineer’s laptop, and withdrawals will remain suspended for up to 48 hours. According to CoinDesk, the stolen funds came from wallets that the exchange presents as collateral for client assets.
This is the next stage of a story we covered in our first article on a possible hacker attack on Binance. Since then, the exchange has confirmed the incident and released its initial findings.
What Binance says
According to a post from Binance’s account on X at 2:25 a.m. Polish time, the preliminary investigation suggests the incident may be linked to a compromised DevOps engineer’s laptop. The attacker reportedly gained access to a service container and submitted unauthorised withdrawal orders.
The post ends with a sentence stating that the exchange found no evidence of its wallets’ private keys being compromised (the text in the version we retrieved is cut off).
A few hours later, Binance published a service status update: deposits are operating normally, while withdrawals remain suspended until the withdrawal service and related addresses have been reinforced. The exchange says withdrawals should resume within 48 hours.
Co-CEO Yi He earlier wrote that users’ funds are safe and that Binance will cover all losses from the attack. The exchange is expected to publish a full analysis once the investigation is complete.
Reserves and the scale of losses
CoinDesk analysed Binance’s monthly reserves report from October 1. The „Binance 14” wallet, from which part of the funds moved, is listed in it as part of the backing for client balances. At that time, the exchange held exactly as much ETH as user balances (100%), and USDC coverage stood at 108.26%.
Around 204.5 thousand ETH in total left the Binance 14 and Binance 16 wallets, which according to CoinDesk is about 5.6% of the exchange’s ether reserves. Until the shortfall is replenished, ETH coverage has therefore dropped to roughly 94%. Coverage for several altcoins also fell, to between 7% and 15% of reserves for ENA, UNI, PEPE and AAVE, among others.
According to CoinDesk, the attacker used the EIP-7702 mechanism on Ethereum to turn the wallet into a „sweeper” that transferred funds to the attacker’s address. Binance holds the SAFU emergency fund, worth about $1 billion in bitcoin. The next reserves report is due on November 1 and will show whether the shortfalls have been made up.
Freezes and estimates
Tether CEO Paolo Ardoino wrote that the company has frozen more than 1.567 billion USDT. According to Changpeng Zhao, Circle’s freeze of USDC amounted to about $823 million. CoinDesk also reports that Ripple froze about $200 million, and World Liberty Financial froze $27 million in its USD1 stablecoin.
The outlet’s headlines refer to losses exceeding $6 billion and to falling prices of bitcoin and ether. Earlier estimates were lower ($2.5–3.5 billion), and Binance has not disclosed its own figure. According to CoinDesk, blockchain analysts point to the North Korean group Lazarus as the likely perpetrator, but this is the assessment of analytics firms, not a finding by authorities or Binance.
What it means for users in Poland
For the coming days, according to Binance’s announcement of up to 48 hours, you will not be able to withdraw funds from the exchange, but you can still make deposits. The exchange says client balances will be covered. This will become clear once withdrawals resume and the reserves report is published. Events like this attract scammers, so use only Binance’s official channels, do not click links in messages, and never share codes or passwords.
