As of 30 October 2026, the short answer to how the Binance hack happened is still preliminary. Investigators believe the breach on 29 October 2026 began with a compromised laptop belonging to a DevOps engineer, which may have let an attacker reach a service container and submit unauthorised withdrawal transactions. That chain is the current working account, not a final conclusion.

The first step in that account is the laptop itself. A DevOps engineer typically works with the systems that build, deploy, and run an exchange's services, so a compromised device in that role can be a serious foothold. The verified facts do not say how the laptop was compromised, so any claim about the exact initial infection would go beyond what is confirmed.

The second step is the service container. According to the preliminary investigation, access to a service container allowed the attacker to submit withdrawal transactions that were not authorised. In plain terms, the attacker is believed to have used legitimate-looking internal access to move funds out, rather than breaking a wallet directly, which is why the distinction matters for understanding the breach.

A key preliminary finding cuts the other way: no evidence of a wallet private key leak has been found so far. That does not prove keys were untouched in every respect, but it does mean investigators have not yet found the kind of key compromise that would explain the theft on its own. Readers should treat that finding as preliminary, since it could change as the investigation continues.

The most technical reported element involves Ethereum feature EIP-7702 and a wallet known as Binance 14. That wallet appeared in Binance's proof of reserves on 1 October, and reports say the attacker used EIP-7702 to turn it into a sweeper. A sweeper, in this context, is a wallet set up to automatically move funds onward, which would help an attacker drain assets quickly once access was gained.

The scale of that movement is large. Around 204,500 ETH was moved, leaving ETH backing near 94 percent, down from 100 percent on 1 October. That drop is a direct measure of the damage in ether terms, and it is one reason the next proof-of-reserves snapshot, due on 1 November 2026, is being watched so closely: it will show whether stolen assets were replaced.

The overall impact is estimated at about $6.3 billion, the largest crypto theft on record, ahead of Bybit's $1.5 billion loss in 2025. About $3 billion has been frozen so far, but the mechanism described here explains the outflow, not the recovery, and the two should not be confused.

Binance co-CEO Yi He has said all losses will be covered from company funds and the SAFU emergency fund, which holds about $1 billion in bitcoin, and that user funds are safe. Deposits and withdrawals were suspended as a precaution, although some reports have said deposits were unaffected, a discrepancy readers should note and check against official Binance channels.

FAQ: How did the hack happen? Preliminarily, via a compromised DevOps engineer's laptop, a service container, and unauthorised withdrawals. What is EIP-7702's role? Reports say it was used to turn the Binance 14 wallet into a sweeper. Is the mechanism confirmed? No, the investigation is ongoing and figures and findings are preliminary.