Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.

The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.

Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.

As an immediate precaution, Binance has:

- temporarily suspended deposits and withdrawals while security checks are completed;

- revoked the affected address authorisation;

- engaged law enforcement and blockchain intelligence partners to trace and recover funds.

Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.

Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.

Hey r/devops,

I built Kestrix (https://gitlab.com/kestrix/kestrix) for myself, to keep my DevOps projects separate from my coding projects. It is a repo-agnostic CI/CD control plane written in Go. Repositories are inputs, and the pipeline is defined separately in HCL (pipeline.tf) instead of in a .gitlab-ci.yml or workflow file inside each repository.

What a pipeline looks like

project "platform_services" { default_image = "golang:1.25-alpine" ci_repo "core" { path = "services/core" } ci_repo "api" { path = "api/v1" } ci_task "unit_tests" { trigger = "repo.core.changed || repo.api.changed" execute { repo = "core" script = "go test ./..." } } ci_task "build_container" { trigger = "repo.core.changed" depends_on = ["unit_tests"] execute { repo = "core" script = "docker build -t app:latest ." } } ci_task "deploy_staging" { trigger = "repo.core.changed" depends_on = ["build_container"] execute { repo = "core" script = "tofu apply -auto-approve" } } ci_task "gate_production" { trigger = "repo.core.changed" manual = true depends_on = ["deploy_staging"] execute { repo = "core" script = "echo approved" } } } 

I checked this example with kestrix validate.

How it behaves

• Trigger resolution: Kestrix parses dependencies, rejects cycles, and evaluates each trigger against the repositories that changed. If only api changed, unit_tests runs and the tasks triggered only by core are skipped.
• Single-task reruns: If one integration test dies on a network timeout, you rerun that node from the UI and only that task executes.
• Manual gates: manual = true pauses a task until an operator approves it.
• Remote runners: They make only outbound HTTPS requests, so they need no inbound ports. In Docker mode, containers run with --cap-drop ALL, --security-opt no-new-privileges, and a PID limit (default 256).
• Terraform / OpenTofu: terraform-provider-kestrix manages Kestrix projects (kestrix_project).

License

The source is public under PolyForm Noncommercial 1.0.0. It is free for non-commercial use, and commercial use needs a paid plan (from $3/month). It is not an OSI open-source license.

Limits

One serve process per database is supported. Multi-instance coordination is not implemented.

• Repository: https://gitlab.com/kestrix/kestrix (GitHub mirror: https://github.com/Draqun/kestrix)
• Documentation: https://kestrix.gitlab.io/kestrix/

Do you think this will catch on? Am I the only one who prefers to keep DevOps projects separate from strictly software development projects?