Binance, the world’s largest cryptocurrency exchange, has suffered a security breach involving approximately $6.3 billion worth of digital assets, in what is being described as the largest cryptocurrency theft on record.
The incident occurred on Thursday, October 29, after attackers gained access to Binance’s wallet infrastructure and carried out unauthorised transactions across multiple blockchain networks.
Blockchain intelligence firms, including TRM Labs and Chainalysis, have linked the attack with high confidence to North Korea’s TraderTraitor hacking group. However, Binance says it is still working with law enforcement to establish the identities of those responsible.
In its initial investigation, Binance said the attackers may have gained access through a compromised DevOps engineer’s laptop, allowing them to enter a service container and initiate unauthorised withdrawals.
The exchange later confirmed that further investigation had uncovered additional points of intrusion. It also said there was no evidence that wallet private keys had been leaked.
About $3bn in Stolen Funds Frozen
Following the breach, Binance worked with blockchain intelligence companies, cryptocurrency issuers and other industry partners to trace and freeze the affected assets.
According to the exchange’s October 30 security update, approximately $3 billion had been frozen on-chain.
TRM Labs also reported that stablecoin issuers and other industry partners had frozen billions of dollars in assets connected to the attack.
The recovery effort has become a race to prevent the attackers from moving the remaining funds through cryptocurrency exchanges, decentralised finance platforms and suspected money-laundering networks.
Chainalysis confirmed that it was monitoring the movement of stolen assets across multiple blockchains, including Bitcoin and Ethereum.
Binance Promises to Cover All Losses
Binance has assured customers that the financial impact of the incident will not be transferred to users.
In its October 30 announcement, the exchange said it would cover the losses through its Secure Asset Fund for Users (SAFU) and corporate treasury.
In a subsequent update published on October 31, Binance said it had set aside more than $6.34 billion in company funds to cover the incident, with more than $5 billion already held in the affected cryptocurrency assets.
The exchange also temporarily suspended withdrawals while security checks and infrastructure improvements were carried out. Deposits and other unaffected services remained operational.
Binance said its technical team was working to restore withdrawal services, with a target of resuming them within approximately 34 hours, subject to the completion of security checks.
North Korea Linked to the Attack
TRM Labs attributed the incident to TraderTraitor, a hacking group associated with North Korea, based on blockchain evidence and similarities with previous cyberattacks.
Chainalysis also said it had high confidence that North Korean hackers were responsible.
The allegations are consistent with previous investigations linking North Korean cyber operations to major cryptocurrency thefts. Pyongyang has repeatedly denied involvement in hacking activities.
North Korean-linked hackers were also blamed for the February 2025 Bybit cryptocurrency exchange attack, in which approximately $1.5 billion was stolen.
The alleged Binance theft is significantly larger and highlights the growing security risks facing cryptocurrency exchanges and digital asset platforms.
Binance Faces Pressure Over Security
Founded in 2017 by Changpeng Zhao, Binance grew into the world’s largest cryptocurrency exchange by trading volume.
The latest incident has raised questions about the security of cryptocurrency exchanges, particularly the systems used to manage large amounts of digital assets and process withdrawals.
Unlike traditional stock markets, cryptocurrency exchanges frequently hold digital assets on behalf of customers, making the protection of their wallet infrastructure particularly important.
Binance says it is continuing to investigate the incident, recover affected assets and strengthen its security systems.
The exchange has also promised to publish an updated proof-of-reserves report after completing its security remediation work.
