Binance said on its Telegram channel that the exploit might have been due to an engineer’s compromised laptop and not the leaked private key of a wallet.

“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the statement said.

“We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.”

Arbitrum Security Council, a group of elected signers with emergency powers to take protective action for the network, took an emergency action to rescue and freeze 74.56 million Arbitrum tokens that were in the Binance hacker’s wallet.

“After significant technical diligence and deliberation, the Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or other Arbitrum users,” the council said on an X post.

“As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet. They are no longer accessible to the address that originally held the funds, and can only be moved by further action of the Security Council or a vote of Arbitrum DAO governance, which will be coordinated with relevant parties,” the post added.

On April 21, the council took similar action to freeze $71 million in ether tied to Kelp DAO exploit.