Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record
About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history.
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the exchange said in a security update published early on October 30.
The company found no evidence of a wallet private key leak and plans to publish a technical post-mortem once the investigation is complete.
Close to $3 billion has been frozen on-chain with help from blockchain partners, according to Binance. The affected address authorisation has been revoked, and law enforcement and blockchain intelligence partners have been brought in to trace and recover the stolen funds.
Binance initially suspended deposits and withdrawals while it ran security checks. In a later update on X, the exchange said deposits are operating normally and withdrawals will stay paused until its team completes a security revamp of the withdrawal service and its related addresses, with withdrawals expected to resume within 48 hours.
“The incident stems from multiple factors,” the company wrote, explaining that its security team is tracing the attack path through the compromised computer, which may have been the entry point.
“Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe,” the exchange told customers. An updated Proof of Reserves is promised after remediation.
“Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice,” the company stated.
Stablecoin issuers step in
Tether and Circle were among the first to freeze stolen funds on the night of the hack.
“In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation,” Circle CEO Jeremy Allaire wrote on X.
Tether CEO Paolo Ardoino posted that the company “froze more than 1.567B USDT related to a potential Binance exchange hack,” adding that “protecting the industry and our partners is our main priority.”
Binance co-founder Changpeng Zhao thanked both companies for the “quick freeze” and confirmed that “it does look like a hack on Binance.” He said he no longer manages the exchange, but that he expects, in his role of shareholder, that all user funds will be covered.
North Korea in the frame
Blockchain intelligence firm TRM Labs attributes the attack with high confidence to TraderTraitor, the North Korean group the FBI named in the $1.5 billion Bybit hack of February 2025. By TRM’s count, about $6.36 billion left Binance wallets on ten blockchains, around four times the amount stolen in the Bybit attack.
Chainalysis reached the same conclusion. “We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack,” the company’s CEO Jonathan Levin wrote on X.
On Ethereum, the hackers took control of a Binance hot wallet using 50 authorizations signed in advance, according to TRM. “Early indicators on the Ethereum activity suggested the attacker had phished the authorizations,” the firm noted, adding that phishing would explain what happened on Ethereum while leaving the other chains unexplained.
Binance wallets on different chains, using different key types and signing schemes, all produced valid signatures for the hackers within about half an hour. TRM’s assessment is that this indicates “a compromise of Binance’s hot wallet signing infrastructure.”
Freezes by Tether, Circle, Ripple, World Liberty Financial and Arbitrum’s Security Council reached about $2.7 billion by early October 30. The hackers still hold more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, and TRM expects that money to move through cross-chain bridges, swap services and over-the-counter brokers next, based on previous large thefts.
The firm advises exchanges to screen deposits against the addresses it has tied to the theft.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
