Binance Update: Attack Began With a Compromised Laptop and Spread Through Additional Entry Points, With No Evidence of Private Key Leaks

Binance has shared new details about how Thursday’s security incident unfolded. The exchange said the attack began with a compromised employee laptop and was carried out through several additional points of entry uncovered as its investigation progressed. In updates on Friday, October 30, Binance said it has found no evidence that wallet private keys were leaked, and that all user losses will be fully covered.A Multi-Stage Attack, Not a Single BreachBinance’s initial findings pointed to a compromised laptop belonging to an employee as the starting point. Its subsequent investigation has identified additional points of breach, showing the incident went beyond one device. The exchange said the attack could not have been completed from a single machine, and that no individual engineer’s permissions could have been used to move the funds in “one click.” The theft involved a more complex, multi-step process.Attacks on crypto institutions are typically highly targeted and use sophisticated methods to infiltrate systems, Binance said. Its investigation has not attributed responsibility to any individual, and the company said it will take responsibility and continue upgrading its security.What the Attackers Did Not ReachBinance said it has found no evidence that wallet private keys were compromised. Outflows stopped as soon as the exchange paused withdrawals, cutting off further movement of funds.Tracing and Freezing the FundsBinance estimates the incident affected about $6.3 billion in assets. About $3 billion has been frozen so far, nearly half of the total, and the exchange is working with partners to freeze more. Because fund flows on the blockchain are publicly traceable, Binance is working with law enforcement and blockchain intelligence firms to track the remaining assets.User Funds Are ProtectedBinance said user funds are safe and users will not bear any losses. All losses will be covered in full by its Secure Asset Fund for Users (SAFU) and company funds. Deposits have stayed open and unaffected throughout, and withdrawals remain on track to resume in about 45 hours, with exact timing to be confirmed in an official announcement.A Full Report to FollowThe investigation is ongoing, and Binance said it will share verified details as they become available. Once its review is complete, it plans to publish a full account of the incident and the further security measures it is putting in place. Binance also urged users to rely only on official channels, as phishing links and fake support accounts often appear after security incidents.