Binance confirmed on Friday that approximately $6.3 billion in cryptocurrencies was stolen during a hacking attack, marking the largest incident of its kind in the history of the crypto industry. The attack took place on Thursday, 29 October, and according to analysis by US firm TRM Labs, the attackers transferred approximately $6.36 billion worth of assets from Binance's digital wallets to addresses under their control. The majority of the funds were transferred within just 20 minutes.
The entry point for the attack was a compromised laptop belonging to one of the engineers responsible for the development and maintenance of the systems. The attackers accessed the digital wallets after exploiting a security flaw associated with that computer, which allowed them to enter a service container through which they initiated unauthorised transactions. They used advanced authorisation protocols to take control of the wallets. The company emphasises that no evidence of compromised private keys for the digital wallets has been found so far, and the root cause of the attack has yet to be determined.
The stolen funds included bitcoin, ether and stablecoins such as tether (USDT) and USDC, and the attack affected multiple blockchain networks, including Bitcoin, Ethereum and Solana. By Thursday evening, US time, companies in the crypto industry had managed to freeze approximately $3 billion in affected tokens. Among them were Tether and Circle, which blocked large amounts of their digital currencies USDT and USDC. Binance revoked the authorisation of the compromised address and involved partner companies in tracking and attempting to recover the stolen cryptocurrencies. A large portion of the assets transferred during the attack has not yet been returned.
Binance stated that it would compensate all resulting losses with its own funds and a fund designated for emergencies, namely the special security fund SAFU. It sent a message to users that their funds are safe and that user assets are protected. The company temporarily suspended deposits and withdrawals to conduct additional security checks. According to the company's latest announcement, deposits are available again, while withdrawals remain temporarily suspended, with the resumption of withdrawals expected within 48 hours. Binance also announced that it would publish a detailed technical report after the investigation is completed.
Experts suspect that North Korean hackers are behind the attack. The firm TRM Labs attributes the attack with a high degree of confidence to a North Korean state-sponsored hacking group known as TraderTraitor and the Lazarus Group. A similar assessment was made by analytics firm Chainalysis, and analysts at Singaporean firm Pangolin Intelligence also expressed suspicion. Analysts point out that the attack method follows a pattern seen in previous major attacks on crypto exchanges, such as the one on the Bybit platform in early 2025, when approximately $1.5 billion was stolen. TraderTraitor is specifically linked to that attack on the Bybit exchange in February 2025. North Korean hackers have previously been linked to major cryptocurrency thefts, and North Korea has previously rejected allegations of such activities. Binance has not yet officially confirmed the identity of the perpetrators, and the company is cooperating with police and digital asset tracing experts to determine who is behind the attack.
Aravind Srinivasan, head of OTC business at firm GSR, described the scale of the attack as the largest hacking incident in history. According to Reuters, Bitcoin fell by more than three per cent during early trading on Friday, reaching its lowest level in six weeks, while Ethereum also recorded a sharp drop. The attack relates to the global platform Binance.com, while the US subsidiary Binance.US stated that its system was not affected. The Binance platform was founded in 2017 by Changpeng Zhao, also known as CZ, who stepped down from the top position in 2023 after pleading guilty to violating US anti-money laundering regulations. Zhao was sentenced to four months in prison, and in October last year he was pardoned by US President Donald Trump.
