30.10.2026 08:10
New details have emerged in the Binance incident, which is said to potentially be the largest cyberattack in cryptocurrency history. It is assessed that the approximately $6.3 billion attack may have been carried out through an employee's compromised laptop. While approximately $3 billion in assets were frozen, it was claimed that $2.4 billion in Bitcoin and Ethereum are in the attackers' wallets.
New details have emerged about the behind-the-scenes of the multibillion-dollar cyberattack on cryptocurrency exchange Binance. According to the company's initial investigations, it is assessed that the attackers infiltrated the system through the compromised laptop of a DevOps engineer and carried out unauthorized withdrawals. The estimated size of assets affected by the attack reached $6.3 billion, while approximately $3 billion worth of assets were frozen. It was reported that approximately $2.4 billion worth of assets in Bitcoin and Ethereum are in the attackers' wallets.
TRACES OF THE MULTIBILLION-DOLLAR ATTACK LEAD TO A SINGLE COMPUTER
Technical investigations into the security issue announced by Binance in the morning have yielded striking findings.
According to the company's statement, it is assessed that the attackers may have gained access to systems by compromising the laptop of an employee working as a DevOps engineer.
It is estimated that through this access, the attackers infiltrated a service environment and carried out unauthorized withdrawals.
Binance reported that no evidence has been found indicating that private keys of cryptocurrency wallets were leaked. How the computer was compromised and the technical details of the attack have not yet been finalized.
$6.3 BILLION IMPACT: COULD BE THE LARGEST CRYPTOCURRENCY THEFT IN HISTORY
In initial investigations, the total value of assets affected by the attack was determined to be approximately $6.3 billion.
While it has not yet been confirmed that the entire amount was permanently lost, it is stated that if the incident is confirmed as a theft of this magnitude, it could be the largest cyberattack in cryptocurrency history.
The largest previously confirmed theft in the cryptocurrency sector occurred in an attack on the Bybit exchange in 2025. In that incident, approximately $1.5 billion worth of digital assets were stolen.
$3 BILLION FROZEN, $2.4 BILLION IN ATTACKERS' WALLETS
Binance had announced in the morning that the verified amount of frozen assets was $2.54 billion.
It was reported that as a result of the work carried out, this amount rose to approximately $3 billion.
A significant portion of the frozen assets consisted of cryptocurrencies pegged to the dollar. Tether and Circle took action to prevent transfers of digital assets linked to the attack.
In contrast, it is stated that approximately $2.4 billion worth of Bitcoin and Ethereum are in wallets controlled by the attackers.
Recovering these assets, however, requires a more complex process than other cryptocurrencies.
SO, WHY CAN'T BILLIONS OF DOLLARS BE FROZEN?
One of the most striking details of the attack was that intervention possibilities vary depending on the type of cryptocurrency stolen.
Companies such as Tether and Circle can stop transfers of some stable cryptocurrencies they issue at specific addresses. In this way, the attackers can be prevented from sending these assets to other wallets.
However, in Bitcoin and Ethereum themselves, there is no central company that can unilaterally freeze assets in a specific wallet.
Therefore, the recovery of Bitcoin and Ethereum under the attackers' control depends on tracing the assets, identifying the attackers, and, when necessary, preventing them from transacting on cooperating cryptocurrency platforms.
According to experts, recovering such assets can take months or even years.
BITCOIN FALLS BELOW $78,000
News of the attack on Binance also caused selling pressure in cryptocurrency markets.
Bitcoin's price fell below $78,000 with a drop exceeding 4%, while Ethereum also lost value.
Cryptocurrency investors are closely following new statements about the scale of the attack and the fate of the assets that cannot be frozen.
BINANCE: WE WILL COVER ALL LOSSES
Following the attack, Binance temporarily suspended deposit and withdrawal transactions until security checks are completed.
The company announced that all losses incurred by users will be covered through its user protection fund called SAFU and its own resources.
It was reported that authorizations for addresses linked to the attack have been revoked and that work is being carried out in coordination with law enforcement and blockchain analysis companies.
Binance also announced that after the investigations are completed, it will publish a detailed report on the technical causes of the attack.
SERVICES CONTINUE AT BINANCE TR
Following developments on the global platform, Binance TR also made a statement to its users.
It was stated that user assets on the platform in Turkey are safe and services continue without interruption.
The company emphasized that security processes are being carried out meticulously.