Binance is dealing with what could become the largest cryptocurrency theft on record after attackers drained approximately $6.3 billion from wallets belonging to the world’s largest crypto exchange. Blockchain intelligence firms have linked the October 29 incident to North Korea’s TraderTraitor hacking group, while Binance has pledged to cover customer losses using its emergency reserve and corporate funds.
The scale of the breach, the speed of the transfers and the involvement of multiple blockchain networks have put centralized exchange security under renewed scrutiny.
Binance estimated the financial impact at approximately $6.3 billion. Blockchain analytics firm TRM Labs independently traced around $6.36 billion in transfers from Binance-controlled wallets across ten blockchains, with most of the funds moved within roughly 20 minutes.
The transfers affected several major networks, including Ethereum, Bitcoin, Tron, XRP Ledger and Solana. TRM’s analysis indicates that the attacker also used an Ethereum wallet delegation mechanism to turn a Binance hot wallet into a transaction tool under their control.
The attack appears to have involved Binance’s withdrawal infrastructure rather than a straightforward leak of wallet private keys. According to the exchange’s preliminary investigation, a compromised laptop belonging to a DevOps engineer may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions.
Binance said it had found no evidence that wallet private keys were leaked. However, the company acknowledged that its investigation had identified additional potential points of compromise and promised a detailed technical report once the facts are verified.
TRM Labs attributed the attack to TraderTraitor, a North Korean hacking unit, with what it described as high confidence. Chainalysis and Elliptic have also linked the incident to North Korean actors.
Investigators point to similarities with previous attacks attributed to the group, including the $1.5 billion Bybit hack in February 2025. The FBI previously identified North Korea and TraderTraitor as responsible for that theft.
The attribution has not been independently confirmed by law enforcement. Binance said it was working with authorities to establish the attackers’ identities. Reuters reported on October 30 that the exchange was cooperating with international law enforcement, including the FBI and the US Secret Service.
Binance said it had coordinated with blockchain partners to freeze approximately $3 billion in affected assets. TRM’s earlier breakdown put the amount at roughly $2.7 billion, including stablecoins frozen by Tether, Circle, Ripple and other issuers, as well as assets restricted through Arbitrum’s security mechanisms.
The difference reflects changing estimates and reporting times as additional funds were identified and frozen.
Freezing stablecoins is possible because centralized issuers can blacklist addresses and prevent tokens from being transferred. Other cryptocurrencies, including Bitcoin and Ether, generally cannot be frozen in the same way. This distinction matters because the attacker has reportedly been converting some stolen stablecoins into assets that are harder to immobilize.
Binance temporarily suspended withdrawals while conducting security checks, although deposits were reported to be unaffected. The exchange said it expected withdrawals to resume within 48 hours.
The company has also committed to covering all losses through its Secure Asset Fund for Users (SAFU) and corporate resources. CoinDesk reported that Binance had arranged more than $6.34 billion to cover the incident, including $5 billion already held in the exact token assets affected. The exchange plans to publish updated proof-of-reserves information after remediation is complete.
The breach quickly affected cryptocurrency markets. Bitcoin fell to a six-week low of approximately $77,646, while Ether reached a two-month low of around $2,239, according to Reuters. BNB dropped more than 8% over 24 hours.
CoinDesk reported that liquidations in crypto futures markets reached approximately $1.57 billion as prices fell, highlighting how an exchange security incident can spill over into leveraged trading.
The implications extend beyond Binance. Institutional investors were reportedly moving funds away from centralized exchanges as the incident renewed concerns about keeping large balances on trading platforms.
The immediate priority is whether Binance can restore normal operations and demonstrate that customer assets remain fully backed. Its commitment to absorb the losses is significant, but the longer-term test will be transparency: a credible technical post-mortem, independently verifiable reserves and evidence that the weaknesses behind the breach have been addressed.
Even if customers are made whole, the incident exposes a central vulnerability in crypto infrastructure. Blockchain transactions may be transparent and irreversible, but the systems that authorize withdrawals from centralized exchanges remain dependent on internal security controls. A failure in those controls can put billions of dollars at risk.