Binance said unauthorized withdrawals from its hot wallets resulted in the loss of about $6.3 billion in digital assets, an incident that independent investigators describe as the largest cryptocurrency theft recorded to date. The exchange said the breach began at approximately 20:05 UTC on October 29 and affected company-controlled transaction wallets rather than the cold-storage system holding most customer assets.
Binance promises to absorb the loss
In its second security update on October 30, Binance said it had reserved more than $6.34 billion in company funds to cover the stolen assets. About $5 billion was already held in the same tokens affected by the breach, including bitcoin, ether, BNB, USDT and USDC. The company said it was buying the remaining assets through market and over-the-counter channels and would use its Secure Asset Fund for Users and corporate treasury to prevent customers from bearing the loss.
Binance also said roughly $3 billion in affected assets had been frozen on-chain with help from token issuers, blockchain intelligence companies and other industry partners. A freeze can stop particular stablecoins from being transferred, but it does not automatically mean the assets have been recovered or returned. Bitcoin and ether do not have central issuers capable of freezing them.
Investigation remains open
The exchange initially said a compromised DevOps engineer’s laptop may have allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. Its later update said investigators had found additional points of breach, while finding no evidence that wallet private keys had leaked. Binance said compromised infrastructure was contained, affected authorizations were revoked and additional controls were introduced. A full technical post-mortem has not yet been released.
Withdrawals were temporarily suspended while security checks, remediation and system validation continued. Deposits and services not connected to the affected infrastructure remained operational, according to Binance. The company said it intended to restore withdrawals in phases, subject to completion of the checks, and planned an updated proof-of-reserves snapshot for November 2.
North Korea link is an external attribution
TRM Labs said approximately $6.36 billion moved from Binance wallets across ten blockchains, with most of the transfers occurring in about 20 minutes. The blockchain intelligence company attributed the operation with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, citing on-chain and off-chain indicators and similarities with earlier attacks. Reuters and the Associated Press reported that other investigators also saw links to North Korean methods.
That attribution has not been confirmed by Binance or a government agency. Binance said it was working with law-enforcement partners to identify the criminals. Reuters reported that the exchange’s investigation had not yet established who carried out the attack, while North Korea routinely denies involvement in cryptocurrency thefts.
Why the incident matters
The scale exceeds the roughly $1.5 billion stolen from Bybit in February 2025, which the FBI attributed to North Korean actors. The Binance attack therefore intensifies scrutiny of centralized exchanges’ signing infrastructure, hot-wallet controls and emergency coordination with asset issuers. The most important unresolved questions are the complete attack path, how multiple systems were reached and how much of the frozen value can ultimately be recovered. Until Binance publishes its post-mortem and authorities complete attribution work, technical and responsibility claims should remain provisional.
