ع
Binance said in a statement that its preliminary findings indicate a compromised DevOps engineer’s laptop allowed an attacker to access a service container and initiate unauthorized withdrawal transactions from hot wallets. The exchange immediately suspended deposits and withdrawals while coordinating with blockchain partners to contain the breach. About $3 billion of the affected assets have been frozen on-chain so far according to Binance data, leaving the status of the remaining funds under active investigation.
TRM Labs reported that the attacker moved approximately $6.36 billion across ten blockchains in roughly 20 minutes beginning at 20:05 UTC on October 29, with Ethereum representing the largest share at $3.79 billion including substantial USDT, USDC and ETH transfers. The firm attributed the operation with high confidence to TraderTraitor, North Korea’s elite hacking unit tied to the Lazarus Group, after matching on-chain behavior to prior incidents. Pangolin Intelligence and Chainalysis separately confirmed similar patterns linking the activity to North Korean actors.
Reuters noted that the breach exceeds the prior record of $1.5 billion stolen from Bybit in February 2025, which was also connected to North Korean hackers. A TRM Labs assessment found that total crypto stolen through nearly 150 incidents reached $2.87 billion during 2025. The latest theft has triggered immediate volatility with widened bid-ask spreads on Binance spot markets for bitcoin and ether.
Yi He, Binance co-founder, said the company would cover all hacking losses from the Secure Asset Fund for Users and its own corporate funds. Changpeng Zhao, the exchange founder, stated that user funds are safe and confirmed the transfers appeared to constitute a hack. Binance added that it expects to publish a full technical analysis once its review concludes.
The attacker secured more than 420,000 ETH and 18,270 BTC valued at around $2.4 billion that issuers cannot freeze, according to TRM Labs tracking. Tether and Circle together froze roughly $2.7 billion in stablecoins while Arbitrum’s security council locked additional tokens on its network. On Ethereum the hackers applied an EIP-7702 delegation to repurpose a Binance hot wallet as a sweeper for incoming assets.
Aravind Srinivasan, head of systematic OTC business at GSR, told Reuters, “It’s the biggest hack in history.” Eric Jardine, head of research at Chainalysis, reported that at least $5.912 billion had been confirmed stolen across multiple chains including Bitcoin, Ethereum and Tron as of late October 29. Tim Sun, senior researcher at HashKey Group, said the incident could extend beyond immediate asset losses to broader reevaluation of risks in cryptocurrency holdings.
