Martha Udom
The world’s largest cryptocurrency exchange, Binance, has reported a security breach with an estimated impact of $6.3 billion, in what could be the largest cryptocurrency theft on record.
Binance confirmed the incident on Friday, October 30, following the movement of approximately $6.36 billion from its wallets across 10 blockchains, according to blockchain intelligence firm TRM Labs.
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. The firm said its assessment was based on on-chain and off-chain intelligence, as well as similarities to previous attacks, including the $1.5 billion theft from cryptocurrency exchange Bybit in February 2025. The FBI previously attributed the Bybit attack to North Korean hackers.
Binance has not publicly identified the attacker, saying it is working with law enforcement agencies and blockchain intelligence partners to establish who was responsible.
The exchange temporarily suspended withdrawals on affected networks while security teams investigated the incident, revoked authorisations linked to the affected addresses and worked with partners to trace and recover the assets.
Binance said approximately $3 billion in affected assets had been frozen on-chain through collaboration with blockchain partners. TRM Labs separately reported that Tether, Circle, Ripple and World Liberty Financial had frozen approximately $2.67 billion in stablecoins as of 00:30 UTC on October 30. The firm estimated that the attacker retained about $2.4 billion in Ether and Bitcoin, which cannot be frozen directly by token issuers.
Preliminary findings from Binance suggest that the attack may have involved a compromised laptop belonging to a DevOps engineer. The attacker allegedly used the access to enter a service container and submit unauthorised withdrawal transactions. Binance said it had found no evidence that wallet private keys were leaked.
The exchange said it would cover all losses using its Secure Asset Fund for Users (SAFU) and company funds, assuring customers that their funds remained safe.
The incident also unsettled cryptocurrency markets, with Bitcoin and Ether prices falling during trading on Friday. The scale of the price movements varied across reports and trading periods.
Binance said it was working with international law enforcement agencies and blockchain intelligence partners to investigate the incident. The exchange said it would publish a detailed technical report after completing its investigation.
