Binance Estimates $6.3B Hot-Wallet Loss as Security Review Continues

Binance estimates that a hot-wallet compromise caused about $6.3 billion in losses, according to its October 30, 2026 second incident update. The company reported roughly $3 billion frozen on-chain and said withdrawals remained suspended. Those figures describe Binance’s account of the incident, rather than independently verified losses or recoveries. As of October 31, 2026 KST, the reviewed material contained no later confirmation that withdrawals had resumed. The immediate distinction is between the exchange’s recovery commitments and what customers could actually access. Binance’s second update supplies the latest reported status.

An attack explanation still taking shape

Binance’s initial notice suggested that a compromised DevOps engineer’s laptop might have enabled access to a service container and unauthorized withdrawal transactions. It said affected address authorization had been revoked and law-enforcement and blockchain-intelligence partners engaged. The notice also said investigators had found no evidence of a wallet private-key leak and promised a technical post-mortem. These were preliminary company findings, not a completed forensic account. The first update did not establish the entire attack sequence.

The later notice reported additional breach points. That leaves the laptop explanation as a possible entry route, with its role still unresolved. A finding of no evidence of leaked keys also carries a narrower meaning than proof that no keys were exposed.

What the Ethereum delegation shows

In an October 30 Binance summary of Richard Teng’s account, the co-CEO said attackers used EIP-7702 to obtain execution over a Binance hot wallet. The summary also described a self-destruct mechanism; that detail remains a company claim. EIP-7702 allows an externally owned Ethereum account to delegate code execution through signed authorizations. The feature itself does not explain how an attacker obtained authorization.

Independent analyses by Bitquery and Hypernative describe an EIP-7702 delegation on the wallet labeled Binance 14, followed by execution that moved assets out. Their published chain records support this mechanism for one Ethereum wallet. They do not establish the authorization method behind outflows on other chains.

The access path remains unresolved: the reviewed evidence does not establish who reached Binance’s signing system, whether the suspected laptop was involved, or whether private keys were compromised. On-chain authorization alone cannot answer those questions. These October 30 accounts predate this article’s original publication; their inclusion fills out the explanation rather than reporting a later development.

Reported freezes leave recovery questions open

The first notice supplied no affected wallet addresses, transaction identifiers or asset-by-asset valuation. Those omissions limit what readers can independently reconstruct from the announcement. A reported freeze should not be counted as money recovered or returned to customers. Binance’s preliminary account leaves those verification gaps open.

Binance subsequently said it had set aside more than $6.34 billion in company funds, including $5 billion in affected tokens, and was acquiring the remainder. It also gave an approximate, conditional target of about 34 hours to begin phased withdrawals. These statements establish commitments, not independently verified funding or completed restoration. The notice’s publication timezone is unstated, preventing a precise KST deadline calculation. The second update is the source for both commitments.

Japan’s statement has a separate scope

Binance Japan said its customer assets were unaffected because they were held in cold wallets separate from the compromised global hot wallets. Nevertheless, it reported a precautionary suspension of crypto withdrawals while crypto deposits, trading and fiat deposits and withdrawals remained available. That is the affiliate’s statement about its own operations, not an independent regulatory finding or evidence covering every Binance entity. Binance Japan’s notice should be read within that boundary.

For related security coverage, the Electrum wallet-flaw report concerns a separate software attack requiring a user signing action. It provides context, not corroboration of this incident.

What the promised reserve check can establish

Binance planned reserve-snapshot results by November 2, 2026; the reviewed material did not contain that completed report. Its general Proof of Reserves page describes address-ownership checks, balance snapshots, Merkle trees and zk-SNARKs, alongside account-balance inclusion checks against a liabilities report.

That methodology describes how Binance says users can assess custody assets against balances. It does not itself verify this incident’s loss, set-aside funds or recovery. The remaining evidence needs are distinct: a technical explanation of the breach, confirmation of restored withdrawals, the promised snapshot and independently checkable recovery records. One announcement cannot substitute for all four.

Sources

• Binance: Security Incident Update — October 30, 2026.
• Binance: Security Incident Update #2 — October 30, 2026.
• Binance Japan: Response notice — October 30, 2026.
• Binance: Proof of Reserves — undated methodology page.
• Binance News: Summary of Richard Teng’s incident account — October 30, 2026.
• Ethereum Improvement Proposals: EIP-7702, Set Code for EOAs — technical specification.
• Bitquery: Binance hot-wallet investigation — October 30, 2026.
• Hypernative: Binance hot-wallet drain analysis — October 30, 2026.