Binance is facing one of the largest cryptocurrency security incidents ever recorded, after an investigation into suspicious withdrawals revealed that approximately $6.3 billion in digital assets had been transferred from wallets controlled by the exchange.
The incident, which unfolded on October 29, has raised questions about the security of cryptocurrency exchanges, the effectiveness of internal controls, and the ability of blockchain investigators to recover stolen funds.
It also presents an uncomfortable irony for Binance. Just a few days earlier, the company had highlighted its role in an international crackdown on online scam networks, where its intelligence helped authorities identify more than $11 million in funds that could potentially be frozen. This juxtaposition raises questions about how cryptocurrency platforms balance their role in fighting financial crime with the security of the infrastructure they operate.
The October 29 incident is different from the scams Binance was helping investigate. Rather than criminals persuading victims to send cryptocurrency, the latest breach involved unauthorized transactions from the exchange’s own infrastructure.
Here is what we know so far.
How the Binance Hack Unfolded
The attack appears to have involved significant preparation.
Blockchain intelligence firm TRM Labs says the attacker began preparing at least 36 hours before the main transfers. The operation subsequently moved across multiple blockchain networks, with investigators tracing activity involving Ethereum, Bitcoin, TRON, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.
On October 29, between 20:04 and 23:56 UTC (23:04 and 02:56 EAT the next day, October 30), Binance-linked wallets transferred approximately $6.3 billion in cryptocurrency to attacker-controlled addresses.
The transfers were not limited to a single wallet or blockchain. TRM Labs identified approximately $6.36 billion in movements across ten networks, with Ethereum accounting for the largest share.
The scale of the transfers became apparent as blockchain observers began tracking suspicious movements from Binance wallets.
The exchange subsequently acknowledged a security incident and temporarily suspended deposits and withdrawals while it investigated.
Binance’s initial investigation points to a compromised laptop belonging to a DevOps engineer. The attacker allegedly used access to a service container to submit unauthorized withdrawal transactions.
The company says it has found no evidence that wallet private keys were leaked. However, it has yet to publish a complete technical post-mortem explaining how the attacker gained access to the withdrawal infrastructure.
The Race to Freeze the Stolen Funds
Once the transfers were identified, cryptocurrency companies and blockchain investigators moved to stop the assets from being moved further.
Binance reported approximately $3 billion in assets frozen on-chain. TRM Labs’ independent analysis put the amount frozen or otherwise intercepted at approximately $2.7 billion in its initial assessment.
The intervention involved Tether, Circle, Ripple, World Liberty Financial, and other participants.
The response highlights an important distinction between cryptocurrencies.
Stablecoins such as USDT and USDC are issued by companies that can freeze tokens associated with specific addresses. Bitcoin and Ether, however, do not have a central issuer capable of unilaterally freezing individual holdings.
That difference has made the recovery operation more complicated.
Blockchain analysis firm Bitquery reported that approximately $729 million in stolen stablecoins had been exchanged before freezes took effect. Some of the funds were converted into Ether and TRON, while other assets were moved through decentralized exchanges and lending protocols.
The attacker was also reported to have used stolen stablecoins as collateral to borrow Ether.
These movements make the remaining funds harder to recover, even though their transactions remain visible on public blockchains.
The North Korean Connection
TRM Labs and Chainalysis have attributed the incident to TraderTraitor, a North Korean hacking group, with high confidence.
The assessment is based on similarities with previous operations, the preparation involved, and the movement of funds after the theft.
TraderTraitor was also linked to the February 2025 Bybit hack, in which approximately $1.5 billion in cryptocurrency was stolen. The FBI formally attributed that incident to North Korea.
However, Binance has not publicly confirmed the identity of the attackers. The attribution remains an intelligence assessment rather than a criminal finding.
If confirmed, the incident would reinforce concerns about North Korea-linked cyber operations targeting cryptocurrency infrastructure.
Is This the Biggest Heist in History?
At approximately $6.3 billion, the Binance incident is substantially larger than the $1.5 billion Bybit theft, making it the largest publicly identified single cryptocurrency theft by gross value.
The comparison with traditional heists is more complicated.
The 2003 removal of approximately $1 billion from Iraq’s Central Bank is one of the most frequently cited historical examples. The Bangladesh Bank cyber heist of 2016 involved an attempted transfer of approximately $951 million, but only around $81 million successfully escaped.
Binance’s reported gross impact exceeds both figures.
However, the $6.3 billion estimate does not represent a confirmed final loss. Approximately $3 billion has been frozen, and the amount that can ultimately be recovered remains unknown.
If most of the funds remain unrecovered, the Binance incident could plausibly become the largest single theft of liquid financial assets ever reported.
For now, the more defensible description is the largest suspected single cryptocurrency theft on record.
What Happens Next?
Binance has said it expects to resume withdrawals within 48 hours, subject to security checks. The company has also promised to cover losses through its Secure Asset Fund for Users (SAFU) and its own funds.
The next major development will be a detailed technical post-mortem explaining how the attacker accessed the withdrawal infrastructure and what changes Binance is making to prevent another breach.
An updated proof of reserves will also be important. Binance says customer funds are safe, but the incident has raised questions about whether the assets backing customer balances have been fully restored.
The recovery operation will continue as investigators trace the remaining funds and work with cryptocurrency companies and law enforcement.
