Binance Hit by $6.3bn Crypto Hack in Largest Theft of Its Kind

Binance, the world’s largest cryptocurrency exchange, has suffered a major security breach involving an estimated $6.3 billion in digital assets, in what blockchain analytics firm TRM Labs describes as the largest cryptocurrency theft in history.

The incident, which occurred on Thursday, 29 October, affected Binance wallets across 10 different blockchain networks, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger.

Blockchain investigators estimate that approximately $6.36 billion was transferred from wallets associated with the exchange, making the incident more than four times the size of the $1.5 billion Bybit hack recorded in February 2025. <Cite refs={[“turn657500search1″,”turn657500news35”]}/>

Binance co-CEO Richard Teng said preliminary investigations suggested that a compromised laptop belonging to a DevOps engineer may have provided hackers with access to an internal service container, enabling unauthorised withdrawal transactions.

He stressed that the attack involved multiple stages and was not a simple one-click operation.

The company said it had found no evidence that wallet private keys were leaked and promised to publish a detailed technical report after completing its investigation.

Binance promises to cover all losses

Following the incident, Binance temporarily suspended deposits and withdrawals while security checks were carried out.

Teng reassured customers that their funds remained safe and confirmed that the company would cover all losses using its Secure Asset Fund for Users (SAFU) and corporate funds.

Binance also announced that it had worked with blockchain partners to freeze approximately $3 billion worth of affected assets.

The exchange said it was cooperating with law enforcement agencies and cryptocurrency intelligence firms to trace and recover the stolen funds.

An updated proof of reserves is also expected once the security measures and recovery operations have been completed. <Cite refs={[“turn657500search0″,”turn657500news35”]}/>

North Korean hackers suspected

Blockchain intelligence firm TRM Labs has attributed the attack to TraderTraitor, a North Korean-linked hacking group, based on what it described as strong on-chain and off-chain evidence.

The group has previously been associated with major cryptocurrency thefts, including the February 2025 attack on Bybit, which resulted in losses estimated at $1.5 billion.

However, no group has publicly claimed responsibility for the latest Binance incident, and the attribution has not been independently confirmed by law enforcement.

TRM Labs said several features of the attack resembled previous North Korean-linked operations, including advance preparation, coordinated transfers and attempts to move stolen assets across multiple blockchain networks.

The company is continuing to track the transactions and alert cryptocurrency platforms and financial institutions to suspicious activity.

Billions in assets frozen

Following the breach, several cryptocurrency companies moved to prevent the stolen funds from being transferred or converted.

Tether, Circle, Ripple and World Liberty Financial froze significant amounts of stablecoins linked to the attack. The Arbitrum network also took emergency action to restrict access to certain stolen assets.

TRM Labs estimated that approximately $2.7 billion had been frozen across different networks by early Friday, while Binance separately reported that about $3 billion had been frozen.

However, investigators believe the attacker still controls billions of dollars in cryptocurrency, including substantial amounts of Ethereum and Bitcoin.

Some of the stolen assets were reportedly converted into other cryptocurrencies in an attempt to move them beyond the reach of companies capable of freezing transactions. <Cite refs={[“turn657500search1″,”turn657500search3”]}/>

Renewed concerns over cryptocurrency security

The incident has intensified concerns about the security of major cryptocurrency exchanges and the growing sophistication of cybercriminal operations.

Binance processes transactions for millions of users worldwide, making the breach particularly significant for the global digital asset industry.

The attack also follows a series of major cryptocurrency thefts in recent years, with North Korean-linked hacking groups repeatedly accused of targeting digital asset platforms to generate funds.

As investigations continue, Binance faces the task of restoring normal operations, recovering affected assets and demonstrating that its security systems can withstand similar attacks.

The company maintains that customer funds are safe and has promised to cover all losses resulting from the incident.