Binance provided an update on the possible source of the hack and the total impact, in what is being reported as possibly the ‘ biggest ever cyber heist ’. The company on Friday issued a statement saying “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop. They noted that the estimated total impact sits at around $6.3 billion.
We will also publish an updated Proof of Reserves once the remediation is complete,” the statement released on social media added. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.
“We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance said that the compromised laptop allowed an attacker to gain access to a service container, and then submit withdrawal transactions which were not authorized.
This is also reportedly the same modus operandi used in the Bybit breach in February 2025 , where $1.5 billion was taken. At $6.3 billion, the Binance hack is the largest crypto theft on record. The FinanceFeeds report noted that with $6.3 billion lost and about $3 billion frozen, about $3.3 billion remains outside Binance’s reach. The SAFU fund which Binance referred to, has $1 billion in Bitcoin from earlier this year, as per the report. This still leaves a gap of about $2.3 billion, which is likely to come out of Binance’s corporate balance sheet.
Binance noted that the company had found no evidence of any wallet private key leak. As per a FinanceFeeds report , there was no need to steal a key, as hackers only needed access to a machine that used it. Binance noted that it is “working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice. The company stated that as immediate steps, it has “temporarily suspended deposits and withdrawals while security checks are completed.
“We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified,” the statement further added. This raises questions about how keys are stored to who and what can ask for a signature, according to the report. Binance has also “revoked the affected address authorisation” and “engaged law enforcement and blockchain intelligence partners to trace and recover funds. Hence, the statement mentions “the company’s funds” alongside SAFU as they have vowed to “cover all losses.”
