Binance disclosed preliminary findings in its investigation into a security incident: according to the announcement, a DevOps engineer’s laptop may have been compromised, potentially allowing the attacker to access a service container and submit unauthorized withdrawal transactions. The key caveats are “preliminary” and “may”—the specific intrusion path has not yet been verified, so the current assessment should not be presented as a final conclusion.

According to Binance’s announcement, the incident’s total impact is estimated at approximately $6.3 billion. The platform said it worked with blockchain partners to freeze approximately $3 billion in related assets on-chain. The two figures mean different things: the first is the estimated impact, while the second is the amount reportedly frozen. A freeze does not mean the funds have been recovered, nor can it be used to calculate the final loss.

Binance also said that it has found no evidence of wallet private keys being leaked. This narrows the risk indicators currently pointed to in the announcement, but “no evidence has been found” does not mean the investigation is over. The announcement said that a detailed technical postmortem would be published once the facts had been fully verified.

In response, Binance said it had temporarily suspended deposits and withdrawals to conduct security checks, revoked the permissions of affected addresses, and was tracking the funds with law enforcement and blockchain intelligence partners. The platform also said it would cover the losses using the SAFU fund and company funds, and that user funds were safe. These are commitments made by the platform in its announcement; whether they are fulfilled will need to be verified against further disclosures. The announcement did not give a timeline for resuming deposits and withdrawals, and said it would update its proof of reserves after the fixes were completed.

What is worth watching next is not a single figure, but whether the technical postmortem clearly explains how the permissions were exploited, how the related authorizations will be improved, and whether progress on remediation and handling of the funds is communicated clearly and consistently.