Binance Finds Multiple Breach Points In Record Hack, Richard Teng Confirms

TL;DR

• Security Timeline: Binance first disclosed a security issue on Thursday, later freezing billions in assets and suspending withdrawals as investigators assessed the scale of the breach and worked with law enforcement partners.
• Attack Details: Initial findings suggest a compromised DevOps engineer’s laptop gave attackers access to submit unauthorized withdrawal transactions, though Richard Teng said the incident involved a more complex attack process.
• Recovery Measures: The exchange has frozen around $3 billion in assets, found additional breach points, revoked affected authorizations, and says all losses will be covered while withdrawal systems undergo security upgrades.
  

  ---

Binance has revealed new details about the security incident that escalated into a record crypto hack, with estimated losses reaching approximately $6.3 billion. The exchange said its investigation has uncovered multiple breach points beyond an initially identified compromised laptop, as executives moved to reassure customers that user funds remain protected and all losses will be covered.

Binance Investigation Expands Following Initial Security Alert

The incident began late Thursday when Binance announced it was actively investigating a potential security issue. Despite the developing situation, the company repeatedly stated that customer funds remained safe. As the investigation progressed, Binance temporarily suspended trading on Binance Alpha and intensified security checks across its systems.

Later that evening, the exchange announced it had frozen $2.54 billion in assets and was coordinating with law enforcement agencies, blockchain intelligence firms, issuers, and industry partners to track and recover funds. By early Friday, Binance confirmed it would cover all losses related to the incident and temporarily suspended withdrawals as an additional precaution. Hours later, the amount of frozen assets increased to roughly $3 billion, highlighting ongoing recovery efforts.

Richard Teng Says Attack Was More Complex Than Initially Believed

According to the exchange‘s initial findings, the breach may have started with a compromised DevOps engineer’s laptop. The attacker allegedly gained access to a service container and submitted unauthorized withdrawal transactions. However, Binance co-CEO Richard Teng stressed that the incident was not the result of a simple compromise or a single employee’s permissions.

I want to speak to you directly about what happened.

Bottom line – your money is safe, and we're covering every loss.

Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a…

— Richard Teng (@_RichardTeng) October 30, 2026

In a public statement, Teng said the attack involved a more complex process and that the investigation has not attributed responsibility to any individual. Teng also stated that investigators have found no evidence of any wallet private key leak. He reiterated that customers’ funds remain safe and confirmed that Binance will use its SAFU fund alongside company resources to cover all losses stemming from the incident.

Additional Breach Points Found as Recovery Efforts Continue

The latest update from Binance identified additional breach points beyond the compromised laptop originally referenced in the investigation. The company did not disclose specific details regarding those vulnerabilities but said remediation efforts remain underway. Binance has revoked affected address authorizations, engaged law enforcement and blockchain intelligence partners, and launched a broader security overhaul of its withdrawal infrastructure. The exchange said deposits continue to operate normally and projected that withdrawal services could resume within approximately 45 hours.