ع
Binance estimated the total impact of the security incident at around 6.3 billion dollars and said it had already worked with industry partners to freeze roughly 3 billion dollars in affected assets on chain. The world’s largest cryptocurrency exchange by volume detailed in a statement that its initial investigation pointed to a compromised laptop used by a DevOps engineer which allowed an attacker to access a service container and submit unauthorized withdrawal transactions. No evidence of a wallet private key leak has been found according to the exchange which pledged to publish a detailed technical post mortem once its probe concludes and to issue an updated proof of reserves after remediation.
Blockchain analysis firm TRM Labs attributed the attack with high confidence to North Korea’s TraderTraitor unit citing similarities in tactics to previous incidents including the 1.5 billion dollar Bybit hack of 2025 that United States authorities linked to Pyongyang. Chainalysis reached a comparable assessment based on its review of on chain patterns and intelligence gathered in the hours after the breach according to reports from CoinDesk. The incident unfolded across ten blockchains with the bulk of the roughly 6.36 billion dollars in movements per TRM Labs occurring within a 20 minute window beginning around 20:16 UTC on October 29.
Stablecoin issuers responded rapidly to the unauthorized transfers with Tether freezing approximately 1.57 billion dollars and Circle securing more than 800 million dollars in USDC as detailed in statements compiled by Cybernews and other outlets. Additional measures on XRP Ledger Arbitrum and related tokens contributed to the roughly 3 billion dollars secured on chain leaving an estimated 3.3 billion dollars primarily in bitcoin and ether still unrecovered since those assets cannot be frozen by issuers. Binance said it continued to trace and freeze further funds while collaborating with law enforcement token projects and blockchain intelligence companies.
The exchange announced a temporary suspension of all deposits withdrawals and certain trading functions including on its Alpha early stage token platform until systems are verified as secure. Co chief executive Yi He stated that Binance would cover all hacking losses from its Secure Asset Fund for Users known as SAFU and from corporate funds adding that user funds are safe. Founder Changpeng Zhao who no longer manages daily operations posted on X that the event does look like a hack on Binance while expressing appreciation for the swift freezes implemented by Tether and Circle.
This breach surpasses the previous record for a crypto theft which stood at 1.5 billion dollars from the Bybit exchange in February 2025 according to data tracked by CryptoTimes and multiple security firms. Bitcoin prices dropped more than 4 percent in the immediate aftermath of the announcement as reported by Nikkei Asia with broader cryptocurrency markets experiencing volatility tied to the news. Analysts at Blockaid and PeckShield who monitored the initial outflows described the attack as exploiting internal operational access rather than breaking core wallet cryptography.
Binance emphasized in its updates that the investigation remains active with further details to be shared as facts are verified. The exchange has revoked authorizations on impacted addresses and continues to coordinate with external partners to maximize asset recovery. Industry tracking by firms such as Arkham Intelligence initially flagged wallet movements exceeding 5.8 billion dollars before Binance provided its consolidated 6.3 billion dollar assessment.
