Binance confirmed a $6.3 billion security breach, with approx $2.7 billion in stolen assets frozen.
The attacker still holds over $2.4 billion in ETH and BTC after moving funds to avoid freezing efforts.
TRM Labs linked the attack to North Korea’s TraderTraitor group and identified a possible compromise of Binance’s hot wallet signing infrastructure.
Binance has confirmed a major security breach involving approximately $6.3 billion in cryptocurrency with nearly $3 billion in affected assets frozen following efforts by the exchange and several crypto companies to stop the stolen funds from moving.
The attack took place on October 29, when billions of dollars in digital assets were transferred without authorization from Binance wallets across 10 blockchain networks. The incident is now considered the largest cryptocurrency theft on record, surpassing the $1.5 billion Bybit hack in February 2025.
Binance said its initial investigation points to a compromised laptop belonging to a DevOps engineer. The attacker allegedly used access gained through the device to enter a service container and submit unauthorized withdrawal transactions.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
– temporarily suspended deposits and withdrawals while security checks are completed;
– revoked the affected address authorisation;
– engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
https://t.co/ywB2mKFy0p
— Binance (@binance) October 30, 2026
Following the discovery, Binance temporarily suspended deposits and withdrawals while carrying out security checks. The exchange also revoked the affected address authorization and contacted law enforcement agencies and blockchain intelligence firms to trace the stolen assets.
Binance said it found no evidence of leaked wallet private keys. It also assured users that their funds remained safe and confirmed that its Secure Asset Fund for Users (SAFU) and company funds would cover all losses.
North Korean Hackers Linked to the Attack as $3B in Assets Frozen
TRM Labs identified TraderTraitor, a North Korean hacking unit , as the group behind the incident. The same group was previously linked to the $1.5 billion Bybit hack in February 2025, which was attributed to North Korean hackers by the FBI.
According to TRM Labs, approximately $6.36 billion worth of digital assets was transferred to attacker-controlled wallets, with most of the funds moved within roughly 20 minutes.
The investigation also revealed how the attacker may have gained control of Binance’s wallet infrastructure. On Ethereum , the attacker reportedly used EIP-7702 authorization to make a Binance hot wallet execute a malicious smart contract. The attacker had prepared 50 pre-signed authorizations, allowing one to match the wallet’s transaction sequence and execute the transfer.
(Source: TRM Labs)
The stolen assets spread across several networks, including Ethereum, Bitcoin, Tron, XRP Ledger and Solana. Ethereum accounted for approximately $3.79 billion of the transfers, followed by Bitcoin at $1.47 billion and Tron at around $628 million.
TRM Labs reported that approximately $2.7 billion in assets had frozen on-chain by October 30. Binance separately reported that the total amount frozen had reached around $3 billion.
Crypto Companies Freeze Billions as Investigation Reveals How Attack Happened
Following the incident, several cryptocurrency companies stepped in to prevent the attacker from moving the stolen assets. Tether, Circle, Ripple and World Liberty Financial froze 2.67 billion dollars in stablecoins linked to the attack. Arbitrum’s Security Council also intervened, freezing 8,426 ETH and 74.6 million ARB.
But, the attacker moved quickly to avoid the freezing efforts. TRM Labs said it sold USDT to market makers and borrowed ETH against USDT via Aave lending protocol. These transactions helped the attacker move part of the stolen funds into assets that could not be frozen directly by stablecoin issuers.
The attacker still holds more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion. Unlike USDT and other centralized stablecoins, these assets cannot be frozen directly by their issuers, making recovery more difficult.
(Source: TRM Labs)
The transfers across other blockchain networks also involved valid signatures, pointing to a possible compromise of Binance’s transaction-signing infrastructure.
Binance has not officially confirmed the identity of the attackers. The exchange said its investigation is ongoing and that it will publish a detailed technical report once the facts have been verified.
The incident also affected broader cryptocurrency market sentiment. Bitcoin fell to $76,000, while Ether dropped more than 3% as news of the breach raised concerns about exchange security.
