As of 30 October 2026, the preliminary account of how the Binance hack happened starts with a person, not a vault: a compromised laptop belonging to a DevOps engineer. Preliminary investigation findings say that compromise may have let an attacker access a service container and submit unauthorised withdrawal transactions. That chain is reported as preliminary, and the investigation is ongoing, so details may change.

A service container, in this context, is a part of Binance's internal systems that can carry out operations such as withdrawals. Access to such a container would not by itself explain everything about the incident, but it would explain how withdrawal transactions could be submitted without the attacker needing to break into user accounts one by one. The verified facts do not go further than this preliminary description, and no additional technical steps should be assumed.

Importantly, preliminary findings also say no evidence of a wallet private key leak has been found so far. That is a significant distinction: it suggests, on a preliminary basis, that the attacker did not obtain the private keys that directly control wallets. Instead, the reported route was through internal system access. Because the finding is preliminary, it should be treated as an early indication rather than a final conclusion.

The second reported mechanism concerns a specific wallet, Binance 14, which appeared in Binance's 1 October proof of reserves. The attacker is reported to have used an Ethereum feature called EIP-7702 on that wallet, turning it into a sweeper. A sweeper, in this reported use, is a wallet set up to move funds out, and about 204,500 ETH is reported to have been moved in this way.

The effect on Binance's ether backing is measurable in the reported figures. ETH backing fell to near 94 percent, from 100 percent on 1 October. That drop is consistent with a large ether movement, and it gives readers a concrete way to see the impact beyond the headline total of about $6.3 billion for the whole breach, which would make it the largest crypto theft on record, surpassing Bybit's $1.5 billion in 2025.

Binance responded by suspending deposits and withdrawals as a precaution. Some reports say deposits were unaffected, so there is a discrepancy in early reporting on that point. The suspension itself fits the preliminary picture: if withdrawal transactions could be submitted through compromised internal access, pausing withdrawals would be a direct way to stop further unauthorised movements while the access point was secured.

After the breach, about $3 billion was frozen, including $2.3 billion in USDT and USDC. Tether froze more than $1.567 billion in USDT, Circle froze about $823 million in USDC, Ripple froze about $200 million, and World Liberty Financial froze $27 million in USD1. Those freezes happened at the issuer level for stablecoins and related assets, and they are separate from Binance's own internal response.

Binance co-CEO Yi He has said all losses will be covered from company funds and the SAFU emergency fund, which holds about $1 billion in bitcoin, and that user funds are safe. She also said she expects withdrawal resumption to begin within the next 48 hours. The next proof-of-reserves snapshot, on 1 November 2026, will show whether stolen assets were replaced. Readers should rely on official Binance channels for updates as the investigation continues.

FAQ: How did the hack happen? Preliminarily, a compromised DevOps engineer's laptop may have given access to a service container used to submit unauthorised withdrawals, with EIP-7702 used on wallet Binance 14. Were private keys leaked? No evidence of a wallet private key leak has been found so far, on a preliminary basis. Is the investigation finished? No, it is ongoing and figures remain preliminary estimates.