Binance Faces Major Security Breach Affecting $6.3 Billion in Assets
Written with artificial intelligence.
On October 30, Binance experienced a significant security incident with an estimated impact of $6.3 billion, including $3 billion in assets that have been frozen by stablecoin issuers. The attack, which may have been facilitated by internal device compromise, raises serious concerns about asset security in the cryptocurrency industry.
Overview of the Incident
On October 30, Binance, one of the world's largest cryptocurrency exchanges, was the target of a major security breach potentially involving $6.3 billion in assets. Approximately $3 billion of these assets have been frozen by stablecoin issuers such as Tether and Circle. The breach's scale could surpass the $1.5 billion theft experienced by Bybit in 2025, marking it as one of the largest in recorded cryptocurrency history.
Attack Mechanism
The attackers exploited the EIP-7702 wallet authorization mechanism to transfer assets from Binance's hot wallets. Initial investigations suggest the breach may be linked to a compromised laptop of a DevOps engineer, leading to unauthorized withdrawal transactions. Binance maintains that there is no evidence of private key theft; however, the investigation is ongoing.
Asset Recovery and Freezing
Following the attack, Tether and Circle froze significant amounts of related assets—$1.57 billion and over $800 million respectively. Binance reported that partners have frozen about $3 billion in assets on-chain. However, freezing does not guarantee recovery, as the attackers have already begun converting stolen assets through decentralized exchanges and lending protocols, raising concerns about liquidity and market impact.
Implications for Binance's Reserves
The breached wallet was part of Binance's publicly disclosed reserve assets, which could affect the exchange's ability to support user balances. Initial analysis indicated that the ETH reserve coverage might have dropped from 100% to around 94%. Binance has committed to covering losses through its SAFU fund and will update its reserve proofs post-investigation.
Broader Security Concerns
This incident underscores the heightened security risks in the cryptocurrency industry, as similar breaches have occurred at other exchanges, including Bitget and a recent attack on Polymarket. The growing complexity of these attacks indicates that vulnerabilities may not solely stem from smart contract flaws or private key theft but also involve internal security protocols and external service providers.
As the situation develops, the focus will remain on whether the stolen assets can be recovered and how Binance will address its reserve status to maintain user confidence.