On 30 October 2026, reports are beginning to explain how the Binance hack happened the day before. The account is still preliminary, and the investigation is ongoing, so the sequence below reflects what has been reported so far rather than a final forensic conclusion. The breach on 29 October 2026 at Binance, the world's largest crypto exchange, is estimated to have affected about $6.3 billion.

The reported starting point is a laptop. A preliminary investigation suggests a DevOps engineer's laptop was compromised, and that compromise may have allowed an attacker to access a service container. A service container, in this context, is a part of Binance's internal systems that runs services, and access to it could provide a route into wider operations.

From that access, the attacker was reportedly able to submit unauthorised withdrawal transactions. That is the key step in the reported chain: it was not described, at this preliminary stage, as a direct theft of wallet private keys. In fact, no evidence of a wallet private key leak has been found so far, according to preliminary findings. That distinction is important, but it is still preliminary and could change.

The next reported step involved the Ethereum feature EIP-7702. The attacker reportedly used EIP-7702 on a wallet called Binance 14, turning it into a sweeper. Binance 14 was included in Binance's proof of reserves dated 1 October 2026. Once turned into a sweeper, the wallet could move funds onward, which helps explain the scale and speed of the reported movement.

That movement was reported at about 204,500 ETH. After it, ETH backing was reported near 94 percent, down from 100 percent on 1 October. Those figures describe the ether side of the incident and will be checked again when the next proof-of-reserves snapshot is published on 1 November 2026, which will show whether stolen assets were replaced.

Binance responded by suspending deposits and withdrawals as a precaution. Co-CEO Yi He has said all losses will be covered from company funds plus the SAFU emergency fund, which holds around $1 billion in bitcoin, and that user funds are safe. Yi He also said she expects withdrawal resumption to begin within the next 48 hours. Some reports say deposits were unaffected, so readers should check official Binance channels for the exact status.

Freezing efforts followed the movement of funds. Around $3 billion has been frozen so far, including $2.3 billion in USDT and USDC. Tether froze more than $1.567 billion in USDT, Circle froze about $823 million in USDC, Ripple froze around $200 million, and World Liberty Financial froze $27 million in USD1. Those actions happened after the withdrawals, not as part of the original hack mechanism.

Attribution is a separate question from mechanism. TRM Labs traced the incident to the North Korean unit TraderTraitor, and other trackers also pointed to North Korea. That is an investigators' claim, not a court finding, and Pyongyang has previously denied hacking allegations. Market impact included Bitcoin falling below $77,000, down about 4.5 percent in 24 hours to $76,664 and later around $77,984, ether down about 3.2 percent, BNB down about 3.9 percent, and over $1 billion in leveraged positions liquidated in 24 hours.

FAQ: How did the hack reportedly start? A compromised DevOps engineer's laptop may have led to access to a service container and unauthorised withdrawals. What role did EIP-7702 play? It was reportedly used on Binance 14 to turn it into a sweeper, with about 204,500 ETH moved. Is this account final? No, the investigation is ongoing, figures are preliminary, and readers should rely on official Binance channels for updates.