Binance is investigating what may be the largest cryptocurrency theft in history, after roughly $6.3 billion was stolen from the exchange in a sophisticated multi-chain attack that researchers link to North Korean hackers.
Binance said early findings suggest the breach began with a compromised DevOps engineer’s laptop, which gave attackers access to a service container and allowed them to initiate unauthorized withdrawals. The exchange said there is no evidence that private wallet keys were leaked, and that a full technical post-mortem will be released once the investigation concludes.
Deposits, which were temporarily suspended, have resumed, while withdrawals remain paused as Binance rebuilds and hardens its withdrawal infrastructure. The company expects withdrawals to restart within 48 hours. It said all customer losses will be covered through its Secure Asset Fund for Users (SAFU) and corporate reserves, and that an updated proof-of-reserves report will follow once remediation is complete.
Recovery efforts began quickly. Circle froze more than $800 million in USDC and Tether froze approximately $1.57 billion in USDT, and further action from Ripple, World Liberty Financial, and Arbitrum’s Security Council brought the total frozen to roughly $2.7 billion by October 30. Binance co-founder Changpeng Zhao (CZ) thanked both stablecoin issuers and acknowledged that preliminary evidence points to a successful hack of the exchange.
Blockchain intelligence firms TRM Labs and Chainalysis both attributed the attack with high confidence to TraderTraitor, a North Korean threat group previously linked to the $1.5 billion Bybit hack in February 2025. TRM estimates that about $6.36 billion was drained across ten blockchains, making the theft roughly four times larger than the Bybit incident. Investigators believe the attackers compromised Binance’s hot-wallet signing infrastructure, enabling valid withdrawal signatures across multiple chains. Roughly 50 pre-signed wallet authorizations observed on Ethereum suggest phishing may have played a role, but researchers say that does not fully explain the multi-chain withdrawals.
In a later update, Binance said investigators uncovered additional security breaches beyond the originally identified laptop. Co-CEO Richard Teng stressed that the incident was not the result of a single employee’s actions and that the company has not attributed responsibility to any individual. Binance said it is continuing to work with law enforcement agencies worldwide to identify those responsible and recover the stolen assets.
Blockchain analysts warn that the attackers still control more than 420,000 ETH and 18,270 BTC, worth roughly $2.4 billion, and may attempt to launder the funds through cross-chain bridges, swap services, and over-the-counter brokers. Exchanges have been advised to screen incoming deposits against addresses linked to the theft.
Make the description more conciseAdd a defender-focused sectionFormat the IOCs as a table
AllPeoplePeopleFilesFilesMeetingsMeetingsEmailsEmails
