Binance which is regulated in the UAE both under ADGM FSRA as well as VARA Dubai, has put the estimated impact of its latest security incident at around $6.3 billion, with approximately $3 billion frozen on-chain, as its initial investigation points to a compromised DevOps engineer’s laptop as a possible entry point. The crypto exchange says it will cover all losses through its Secure Asset Fund for Users, known as SAFU, and company funds, while investigators work to establish how unauthorized withdrawals were submitted.

The figure would make this the largest publicly reported crypto theft on record, exceeding the roughly $1.5 billion stolen from Bybit in February 2025. However, Binance’s estimated total impact is not a final accounting of unrecovered losses, and assets frozen on chain have not necessarily been returned to the exchange.

According to Binance’s October 30 update, the compromised computer may have allowed an attacker to access a service container, an environment used to run software and submit unauthorised withdrawal transactions. The company says investigators have found no evidence that wallet private keys were leaked. It has revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners to trace and recover assets.

While the initial announcement listed a temporary suspension of both deposits and withdrawals, a subsequent Binance update says deposits are operating normally. Withdrawals remain paused while the exchange revamps its withdrawal service and related address controls, with Binance expecting to resume them within 48 hours. That is a target, not confirmation that withdrawals have reopened. Binance also says multiple factors contributed to the incident and that a comprehensive root-cause report will follow.

How could funds move without a private key leak?

The distinction is between stealing a wallet’s private key and gaining access to a system authorised to use it. An attacker who can manipulate that system may be able to obtain valid transaction approvals without extracting the key itself. Binance’s preliminary account points towards misuse of internal withdrawal infrastructure, but the exchange has not yet published the full chain of events or identified every control that failed.

In its technical analysis, blockchain security company Blockaid reports that an Ethereum hot wallet labelled Binance 14 was delegated to an attacker-controlled smart contract through EIP-7702, an Ethereum feature that allows a wallet to delegate execution to code. Blockaid says the contract then drained assets and that additional Binance wallets on other networks sent funds to the same receiving address. These are the security company’s findings, rather than Binance’s completed technical conclusions; the Ethereum mechanism alone does not explain how access was obtained across every affected network.

Blockaid’s early tally of at least $5.5 billion was published while the incident was still developing. Binance’s later estimate of $6.3 billion is the figure used here. Neither the speed of the transfers nor their scale, on its own, establishes that artificial intelligence was used to carry out the attack.

Was AI involved?

The clearest publicly documented AI involvement so far is on the defensive side. Blockaid says it used advanced AI models alongside its exploit-detection engine to identify the incident in under two minutes. Its report says automated analysis identified the signing and delegation mechanism within 11 minutes. These are claims about detecting and analysing the theft, not evidence that an AI system planned or executed it.

The Binance statements and technical material reviewed for this article do not establish that attackers used AI to compromise the laptop, generate malicious code or initiate withdrawals. How the computer was first compromised remains an open question. Calling this an AI-led hack would therefore go beyond the available evidence.

Frozen funds are not yet recovered funds

Stablecoin issuers have played a major role in containing the damage. Tether reported freezing more than $1.567 billion in USDT, while Circle reported freezing over $800 million in USDC, according to public statements reproduced in reporting on the incident. Binance’s approximately $3 billion figure covers its verified total frozen across affected assets and partners, not just those two issuers.

As CNBC reports, freezing tokens prevents movement, but returning them involves further coordination and legal processes. The roughly $3.3 billion gap between Binance’s estimated impact and its reported frozen total should not be treated as a confirmed final loss. Binance has promised an updated Proof of Reserves after remediation, alongside its technical post-mortem.

Exchange hacks over the past two years

The incident follows several exchange breaches within the past two years, from October 30, 2024 to October 30, 2026. UAE-based M2 suffered a $13.7 million breach on October 31, 2024, and said customer funds were restored, as Lara on the Block reported. Phemex’s January 23, 2025 hot-wallet attack produced differing public estimates, with PeckShield putting losses at about $69.1 million and other researchers estimating as much as $85 million, according to contemporaneous reporting. On February 21, 2025, Bybit lost approximately $1.46 billion from an Ethereum cold wallet, according to the exchange’s incident timeline; subsequent analysis linked the theft to a compromised Safe wallet developer environment and manipulation of the transaction-approval interface. These incidents involved different systems and attack paths, and do not establish that the same method was used at Binance.

For Binance, the questions now extend beyond the headline figure: how the laptop was compromised, which permissions enabled the withdrawals, how much can ultimately be recovered and when withdrawals will safely resume. Until the promised investigation is published, the compromised laptop remains a preliminary entry-point explanation, while any role for AI in carrying out the theft remains unproven.