Binance Security Incident: 2025 $19B Liquidation, 2026 $6.3B Hack News
Binance Security Incident: $6.3B Impact and What Users Should Know
October has now brought two major shocks to the same crypto exchange, one year apart.
In October 2025, a sudden market crash caused heavy liquidations and platform glitches. In October 2026, the company disclosed a Binance security incident with an estimated impact of around $6.3 billion.
The two events are often mentioned together, but official statements show they were very different in cause, size and response.
Key Points
-
The newest update was published on October 30, 2026 and estimates the total impact at about $6.3 billion.
-
About $3 billion has been frozen on-chain so far.
-
The exchange says it will cover all losses from its SAFU fund and company funds, and that user funds are safe.
-
The first findings point to a compromised engineer’s laptop, not a leaked wallet key.
-
The 2025 crash was driven mainly by market conditions, according to the exchange’s own review, though two platform problems made the day harder for users.
The New Incident: What Has Been Confirmed
According to the official Security Incident Update published on October 30, 2026, an initial investigation suggests the problem may involve a compromised DevOps engineer’s laptop.
An attacker used it to reach a service container and submit unauthorized withdrawal transactions. The same message was shared in an official post on X.
The update gives two headline numbers. The estimated total impact is around $6.3 billion, and about $3 billion has been frozen on-chain with help from blockchain partners.
By our own arithmetic, that means a little under half of the estimated impact is frozen, and the update does not explain the remaining gap of roughly $3.3 billion. The wording “estimated” also tells us the final figure could change.
Here is a quick view of what is known and what is not:
| Topic | Status |
| Estimated total impact | Around $6.3 billion |
| Assets frozen on-chain | About $3 billion so far |
| Wallet private key leak | No evidence found |
| Who pays for losses | SAFU fund and company funds |
| User funds | Described as safe |
| Deposits and withdrawals | Temporarily suspended |
| Technical post-mortem | Promised after the investigation |
| Attacker identity | Not yet confirmed |
The company also says it is working closely with law enforcement to confirm the identity of the people responsible and bring them to justice.
How the Attack Appears to Have Worked
In simple terms, a DevOps engineer is someone who keeps an exchange’s internal systems running.
If that person’s laptop is taken over, an attacker may borrow its access. The update says that access allowed the attacker to enter a service container, which is a small software environment that runs one part of the platform, and then send withdrawal requests nobody had approved.
The exchange stresses that it has found no evidence of any wallet private key leak. That matters because private keys are the master passwords for stored coins.
This Binance security incident therefore appears to be about misused access, not about stolen keys, although the company says its findings are still preliminary and will be verified before a full report.
A few terms from the update are worth explaining:
| Term | Simple meaning |
| Unauthorized withdrawal transactions | Requests to move coins out that the company did not approve |
| Revoked address authorisation | Permission tied to the affected addresses was cancelled. |
| Frozen on-chain | Partners blocked the affected assets from moving further. |
| Proof of Reserves | A public check that the exchange holds the assets it owes users |
As an immediate response, the exchange:
-
Suspended deposits and withdrawals while security checks are completed
-
Revoked the affected address authorization
-
Brought in law enforcement and blockchain intelligence partners to trace and recover funds
It also promised an updated proof of reserves once repairs are complete, and a detailed technical report after the facts are fully verified. Users are asked to rely only on official channels for updates.
October 10, 2025: What Happened and Why
The earlier event was not a hack. In its statement on market volatility, the company said that between 20:50 and 22:00 UTC on October 10, 2025, global macroeconomic events triggered extreme volatility, and both institutional and retail traders sold heavily. The crypto market fell sharply together.
A later official review lays out the causes in more detail:
-
Trade-war headlines: Financial markets fell sharply, and U.S. stocks lost roughly $1.5 trillion in value that day.
-
High leverage: Crypto had rallied for months, and Bitcoin futures and options open interest exceeded $100 billion, which made forced selling easier.
-
Market makers stepping back: Their automatic risk controls pulled liquidity from order books. The blog cites data showing that most major exchanges had almost no bids within a 4% price spread, with a few exceptions.
-
Network congestion: Ethereum fees jumped from single digits to over 100 gwei at times, which slowed transfers between exchanges.
The exchange also gave a timeline. Prices fell to their lowest point between 21:20 and 21:21 UTC, while the severe depegging happened after 21:36 UTC.
The review adds that roughly 75% of that day’s liquidations had already happened before the depeg. In the exchange’s view, this shows the depeg did not start the crash.
The 2025 Platform Problems, Compensation and Fixes
Even so, the company accepted responsibility for two platform-specific problems. The blog explains each one.
| Problem | Time (UTC) | Cause | Fix |
| Transfer slowdown | 21:18 to 21:51 | A heavily used data call lacked caching, so database connections filled up under 5 to 10 times normal traffic | More caching, bigger database capacity, separated critical functions |
| Index deviations for USDe, WBETH, BNSOL | 21:36 to 22:15 | Price inputs leaned too much on the exchange’s own thin order books | Tighter limits and a new method for these tokens |
Some users also saw balances shown as “0” for a short time. The post says this was a display fallback when backend calls failed, not a loss of funds.
Two other points drew attention. First, some trading pairs showed extremely low prices because old limit orders, some from as far back as 2019, were hit when buyers disappeared.
Second, a chart display update on October 12 was misunderstood as an attempt to change data, so the company rolled it back and said it has never tampered with trading or historical data.
On compensation, the announcement says the depeg compensation totaled approximately $283 million, paid in two batches.
By October 22, 2025, the blog says over $328 million had been credited to eligible users.
The company also launched a $300 million goodwill program and a $100 million low-interest loan fund for institutions.
In an update the next day, it added that it would report any suspicious trading it identifies to the regulator, as required.
Two Events, One Exchange: What Comes Next
| Point | October 2025 | October 2026 |
| Type | Market crash with platform strain | |
| Main trigger | Macro shock, leverage, thin liquidity | Possible compromised engineer laptop |
| Core systems | Described as operating throughout | Withdrawals and deposits paused |
| Figure cited | Over $328 million credited to users | About $6.3 billion estimated impact |
| Funds status | Eligible users compensated | Losses to be covered; about $3 billion frozen |
The official statements reviewed here do not connect the two events. Last year’s problems involved market stress and technical limits, while the new case involves unauthorized access.
They are separate lessons: one is about handling extreme trading, and the other is about protecting internal systems.
Many readers also ask why this happened now. The exchange has not given an official reason or explained the timing, and the date of the attack itself is not stated in the update.
Until the promised technical report arrives, any answer would be speculation.
Several official steps will show how serious and how contained this Binance security incident really is:
-
The detailed technical post-mortem
-
The updated Proof of Reserves
-
When deposits and withdrawals resume
-
Further updates on frozen assets and recovery
-
Confirmation of who carried out the attack
Conclusion
The two October events show how different risks can hit one platform in a single year.
The 2025 crash was mainly a market story with platform strain, while the 2026 case is a security story with a very large estimated impact.
Because the investigation is still in progress, readers should treat every number as preliminary and follow the exchange’s own updates on this Binance security incident.
Disclaimer
This article is for educational and informational purposes only and is not financial or investment advice. Crypto assets are high risk, their prices can be very volatile, and you can lose some or all of your money. Always do your own research and consider speaking with a licensed financial advisor before making investment decisions.
