The world’s largest cryptocurrency exchange, Binance, has suffered a massive cyberattack in which hackers reportedly stole approximately $6.3 billion worth of digital assets, making it potentially the largest cryptocurrency theft in history.
Blockchain intelligence companies have linked the attack with high confidence to North Korea’s state linked hacking group, although the investigation is still underway.
Following the incident, Binance suspended cryptocurrency withdrawals while assuring customers that their funds would remain protected. The company has also announced that it will use its own financial resources to cover the losses.
The attack triggered concerns across cryptocurrency markets, with Bitcoin, Ethereum and other digital assets experiencing significant price declines.
How did the $6.3 billion theft happen?
- According to preliminary findings, hackers compromised an internal system associated with Binance’s transaction approval process.
- Binance co-CEO Richard Teng said the initial investigation pointed towards a compromised laptop belonging to a DevOps engineer. The attackers allegedly used the access to enter an internal service environment and submit unauthorised withdrawal transactions.
- The hackers reportedly manipulated the system responsible for approving transactions, allowing them to transfer funds from Binance controlled internet connected wallets, commonly known as hot wallets.
- Blockchain analysis firm TRM Labs estimated that approximately $6.36 billion was transferred across ten different blockchain networks.
- A major portion of the stolen assets was reportedly moved within approximately 20 minutes, beginning late on October 29.
- Binance said it had found no evidence that wallet private keys were leaked. However, its investigation subsequently identified additional possible points of breach.
North Korean hackers suspected
- Blockchain intelligence companies TRM Labs and Chainalysis have attributed the attack with high confidence to TraderTraitor, a hacking operation associated with North Korea.
- The group is also linked to the Lazarus Group, which has previously been accused of conducting major cryptocurrency thefts.
- The FBI previously attributed the February 2025 Bybit cryptocurrency exchange hack, involving approximately $1.5 billion, to North Korean hackers.
- Investigators say similarities in the techniques, speed and movement of stolen funds point towards the involvement of the same hacking network.
- North Korea has routinely denied involvement in previous cryptocurrency theft allegations.
- Binance is cooperating with law enforcement agencies, including the FBI, as investigators work to identify those responsible and trace the stolen assets.
Binance promises to cover all customer losses
Following the incident, Binance announced that it would use its own financial resources to cover the losses rather than using customer funds.
The company said it had set aside approximately $6.34 billion to restore affected customer balances.
According to the company’s latest reported figures:
- Approximately $6.3 billion worth of digital assets were stolen.
- Around $3 billion of the affected assets had been located or frozen.
- Approximately $5 billion in matching tokens was already held by Binance.
- The company was arranging the remaining amount through market and over the counter purchases.
- Binance co-CEO Richard Teng said customer funds were safe and that the company would cover the confirmed losses.
- The exchange also has a Secure Asset Fund for Users (SAFU), an emergency reserve intended to protect customers in exceptional situations.
Stablecoin companies freeze billions in stolen assets
One of the significant developments following the attack was the involvement of cryptocurrency companies in freezing assets linked to the incident.
Stablecoin issuers and other industry partners reportedly moved to prevent hackers from transferring or converting some of the stolen funds.
According to reports:
- Tether: Froze nearly $1.57 billion in assets connected to the incident.
- Circle: Froze more than $800 million in affected assets.
- Other industry partners: Also assisted in identifying and restricting suspicious funds.
These actions helped authorities and investigators locate or freeze a substantial portion of the stolen assets.
However, freezing cryptocurrency does not necessarily mean the money has been recovered or returned to its rightful owners.
Binance suspends withdrawals
- As a precautionary measure, Binance temporarily suspended cryptocurrency withdrawals while conducting security checks and investigating the breach.
- The exchange said deposits remained open and that it was working with cybersecurity experts, blockchain intelligence companies and law enforcement agencies.
- Binance initially expected withdrawal services to resume within 48 hours. Subsequent updates indicated that the company was working towards restoring services after completing security checks.
- The suspension raised concerns among cryptocurrency users about the safety and accessibility of digital assets held on centralised exchanges.
Cryptocurrency markets react to the attack
The massive theft created uncertainty across cryptocurrency markets, triggering selling pressure in several major digital assets.
According to market reports:
- Bitcoin: Fell to approximately $76,368, its lowest level in around six weeks.
- Ethereum: Dropped more than 3% to approximately $2,178.
- BNB: Binance’s associated cryptocurrency also experienced significant selling pressure.
Other digital assets and decentralised finance tokens also recorded declines as investors reacted to concerns about exchange security.
Markets subsequently showed signs of stabilisation, although uncertainty remained surrounding the investigation and recovery of stolen funds.
Why is this attack considered significant?
The Binance incident highlights the growing cybersecurity risks facing the global cryptocurrency industry.
Cryptocurrency exchanges hold and process enormous amounts of digital assets, making their internal systems attractive targets for sophisticated cybercriminal groups.
The incident raises several important questions:
- How can hackers gain access to internal transaction approval systems?
- Are existing security checks sufficient to prevent unauthorised withdrawals?
- How can cryptocurrency companies protect customer assets against sophisticated cyberattacks?
- What international cooperation is required to trace and recover stolen digital currencies?
- Should cryptocurrency exchanges strengthen independent security audits and transaction monitoring?
The incident may also increase regulatory scrutiny of cryptocurrency exchanges and their responsibility to protect customer assets.
Conclusion
- The reported $6.3 billion Binance theft represents a major cybersecurity challenge for the global cryptocurrency industry.
- Although Binance has promised to cover customer losses and several cryptocurrency companies have frozen substantial amounts of suspicious assets, recovering the remaining funds and completing the investigation could take considerable time.
- The incident also demonstrates how sophisticated cybercriminal networks can exploit weaknesses in digital financial infrastructure.
- As cryptocurrency adoption continues to grow worldwide, stronger cybersecurity systems, transparent financial safeguards and international cooperation will be essential to maintaining public confidence in digital financial services.
