Binance Hit by $6.3 Billion Crypto Theft

Binance, the world's largest cryptocurrency exchange, has suffered a major cyberattack in which approximately $6.3 billion in digital assets was moved from its wallets. US-based blockchain intelligence firms TRM Labs and Chainalysis have pointed to suspected involvement by North Korean hackers. The incident is being described as the largest cryptocurrency theft on record, raising fresh concerns about investor confidence in digital asset security.

The main phase of the attack began late on Thursday, October 29, and unfolded within approximately 20 minutes. However, transfers from Binance wallets across multiple blockchain networks continued for several hours. News of the incident triggered a decline in cryptocurrency prices. Binance temporarily suspended deposits and withdrawals on several networks as it responded to the incident. The company said it would cover financial losses suffered by affected users.

Bitcoin and Ether Prices Slide

Following the news, Bitcoin fell to $76,368, its lowest level in six weeks. Ether dropped more than 3% to $2,178, its lowest price in two months. Binance's native cryptocurrency, BNB, also fell 5% over 24 hours to $709.70.

The volatility also affected shares of publicly traded companies linked to the cryptocurrency market. Shares of crypto exchange Coinbase Global fell 4.8%. The company said it was not affected by the attack. Strategy, a company known for its large Bitcoin purchases, saw its shares fall nearly 6% in after-hours US trading. Arvind Srinivasan of market-making firm GSR described the incident as the biggest hacking event in history.

How the Attack Unfolded

According to TRM Labs, attackers managed to direct digital wallets used by Binance to transfer assets into wallets under their control. Approximately $6.3 billion in assets was moved from Binance wallets across 10 blockchain networks.

TRM attributed the attack to TraderTraitor, an elite North Korean hacking unit, and said it had a high level of confidence in that assessment. The firm said the attack bore similarities to the major cyberattack on crypto exchange Bybit in 2025, when approximately $1.5 billion in cryptocurrency was stolen. The US Federal Bureau of Investigation attributed that attack to North Korea.

Chainalysis also expressed a high degree of confidence in the suspected North Korean connection. Binance, however, has not publicly attributed the incident to any specific individual or group.

North Korea Faces Renewed Scrutiny

Authorities in the United States and South Korea, along with cybersecurity specialists, say North Korea has for years used state-sponsored cyber units for espionage, financial theft and revenue generation.  Pyongyang routinely denies such allegations. Reuters contacted North Korea's mission to the United Nations in Geneva and its embassy in China for comment, but received no immediate response.

In an analysis published on its website, TRM said: “Our assessment is that North Korea's elite hacking unit is responsible for this attack.” The firm also highlighted similarities between the incident and previous operations linked to North Korean cyber actors.

Engineer's Laptop May Have Provided Entry Point

Binance's preliminary investigation suggests that the attack may have started with the compromise of a laptop belonging to one of the company's engineers. The attackers may have used that computer to gain access to a Binance system and initiate unauthorized asset transfers.

Binance said: “The compromised computer may have been the entry point for this incident. Our security team is working to trace the entire attack path through that computer.”

Mark Karpeles, former head of the now-defunct Tokyo-based Bitcoin exchange Mt. Gox, said the attackers may have obtained the private keys for at least two Binance wallets.

However, Binance's preliminary findings said there was no evidence that wallet private keys had been leaked. How the engineer's computer was used and where the security controls failed remain part of the ongoing investigation.

Around $2.7 Billion in Assets Frozen

Binance said user funds remained safe and that it was working with industry partners to freeze assets linked to the incident. The exchange initially reported that approximately $3 billion in assets had been identified or frozen. However, assets being frozen is not the same as funds being fully recovered. The whereabouts and recovery prospects of the remaining assets are still under investigation.

Stablecoin issuer Tether said it had frozen approximately $1.57 billion in assets linked to the incident. Circle froze more than $800 million. TRM's assessment put the total amount frozen by Tether, Circle, Ripple, World Liberty Financial and other entities at approximately $2.7 billion. Arbitrum's Security Council also took steps to lock certain assets on its network.

World Liberty Financial said it worked with custodian BitGo to freeze assets. Binance co-founder Yi He said $27 million in stablecoins and approximately $2 million in World Liberty tokens had been frozen. She also said crypto company Ripple had frozen approximately $200 million in assets.

Binance co-CEO Richard Teng wrote on social media platform X: “Your funds are safe, and we are taking responsibility for all losses. Our investigation has not yet identified any specific individual as responsible.”

The company said it was conducting security checks and taking the necessary steps to resume withdrawals. It had initially expressed hope that withdrawal services could return within 48 hours.

Fresh Pressure on Investor Confidence

Analysts say the impact of the attack may extend beyond the immediate financial losses. The cryptocurrency market was already under pressure from rising US interest rates and weaker investor demand for exchange-traded funds (ETFs).

Tim Sun, a senior researcher at Hong Kong-based HashKey Group, said: “This incident could further reduce investors' appetite for risk. It may also force them to reconsider the security of assets held on centrally operated exchanges.”

Binance provides users with facilities to buy, sell and trade digital assets. According to its 2025 annual report, the exchange had 335 million registered users worldwide. Assets held in custody on behalf of customers amounted to approximately $162.8 billion.

Theft Exceeds Binance's Security Fund

Binance maintains a dedicated fund to protect users' digital assets in the event of cyberattacks or security incidents. Known as the Secure Asset Fund for Users, or SAFU, the fund holds $1 billion entirely in Bitcoin.

Co-CEO Richard Teng said the company would use both the SAFU fund and its own corporate funds to compensate affected users. Although the reported theft is several times larger than the fund's stated value, Binance says the company will bear the financial impact rather than passing losses on to customers.

The incident is the latest in a series of major cryptocurrency thefts. According to TRM Labs researchers, approximately $2.9 billion in cryptocurrency was stolen in around 150 separate cyberattacks last year.

In September, crypto exchange Bitget also reported that approximately $350 million in cryptocurrency had been stolen from its platform. These incidents have renewed scrutiny of digital asset security, risk management at centralized exchanges and the safeguards used to protect customer holdings.

//DBTech/JNOR/SME/MVNO//