By 
In a shocking development in the cryptocurrency market, Binance, one of the world's leading exchanges, announced that it has lost approximately $6.3 billion in a major theft, potentially the largest cryptocurrency heist ever recorded. This criminal breach, disclosed on October 30, has sent shockwaves throughout the digital finance community, raising serious concerns about security protocols in the rapidly evolving world of cryptocurrencies.
The exchange's preliminary investigation indicates the incident may have stemmed from a compromised laptop of a DevOps engineer. This access appears to have enabled an attacker to infiltrate a service container and execute unauthorised withdrawal transactions. Binance has assured its users that there is currently no evidence of a leak of private keys from its wallets. The firm has committed to providing a detailed technical analysis and post-mortem once the investigation has concluded.
As part of their immediate response, Binance blacklisted the affected address and, with the assistance of various blockchain partners and law enforcement, successfully froze nearly $3 billion in funds that were on-chain. The firm temporarily suspended all deposit and withdrawal services while carrying out in-depth security checks. However, they later confirmed that normal deposit operations have resumed, although withdrawals will remain on hold until their security team completes a revamp of the withdrawal process, which is anticipated to be in place within 48 hours.
Fillers of the attack call into question multiple layers of Binance's security framework. The exchange's team is actively tracing the attack's path, aiming to understand the breach's full scope. Despite the alarming nature of the incident, Binance has reassured customers that user funds are safe, stating that all losses will be covered by its Secure Asset Fund for Users (SAFU) and company resources. An updated Proof of Reserves is expected to be released after the remediation efforts are finalised. In their communication, Binance’s management emphasised their dedication to resolving the issue thoroughly and efficiently, collaborating closely with law enforcement to identify the criminals behind the hack.
In the immediate aftermath of the theft, major stablecoin issuers such as Tether and Circle took prompt action to mitigate further losses. Their teams coordinated with law enforcement to freeze stolen funds, with reports indicating that more than $800 million in USDC and approximately $1.57 billion in USDT associated with the event were prevented from being moved. Circle's CEO, Jeremy Allaire, confirmed the corporation's commitment to supporting the ongoing investigation, while Tether’s CEO reiterated their prioritisation of safeguarding the industry and its partners. Binance’s co-founder, Changpeng Zhao, extended his gratitude to these companies for their swift actions, labelling the event unequivocally a hack on Binance.
Experts have begun to identify potential culprits behind this audacious attack. TRM Labs, a blockchain intelligence company, has indicated with strong confidence that the group behind the hack is likely TraderTraitor, a North Korean syndicate previously connected to the notorious $1.5 billion hack of Bybit in February 2025. According to TRM, around $6.36 billion was transferred out of Binance wallets across ten different blockchains, significantly exceeding the amount stolen in the Bybit incident.
Analysis from Chainalysis arrived at a similar conclusion, attributing the Binance hack to the North Korean group due to evident links to their previous malicious activities. An investigation into the Ethereum blockchain revealed that the attackers had managed to seize control of a Binance hot wallet by using 50 pre-signed authorisations. By phishers, the attackers may have either tricked users into signing these authorisations or otherwise compromised the signing infrastructure of Binance’s hot wallets.
In total, by early October 30, it was reported that freezes imposed by various crypto entities such as Ripple and World Liberty Financial amounted to approximately $2.7 billion. Despite these efforts, the hackers are still believed to possess over 420,000 ETH and 18,270 BTC, a cache valued at around $2.4 billion. The speculation is that the stolen funds will soon be laundered through cross-chain bridges, swap services, and over-the-counter brokers, a tactic often used in previous high-profile thefts.
As the situation continues to develop, exchanges worldwide are being advised to implement stringent monitoring measures for any deposits linked to the addresses identified as part of the theft. The profound implications of this incident highlight the vulnerabilities in the cryptocurrency landscape and underscore the necessity for robust security measures to protect digital assets in an ever-evolving threat environment.
Source: helpnetsecurity.com
