Binance, the world’s largest cryptocurrency exchange, has suffered an unprecedented cyberattack affecting approximately $6.3 billion in digital assets. The company has already managed to freeze roughly half of the funds and has pledged to cover all customer losses. Security researchers believe North Korean hackers were likely behind what could be the largest cryptocurrency theft in history.
The attack took place on Thursday, October 29, surpassing all previous cryptocurrency thefts in scale. The previous record was set in February 2025, when hackers stole approximately $1.5 billion from the Bybit exchange.
According to blockchain intelligence firm TRM Labs, the attackers transferred funds from Binance wallets across ten different blockchains. Most of the suspicious transactions occurred within just 20 minutes.
Compromised Employee Laptop May Have Enabled the Attack
Preliminary findings from Binance’s internal investigation suggest that the breach may have originated from a compromised laptop belonging to one of the exchange’s DevOps engineers.
The attackers reportedly exploited this access to infiltrate internal infrastructure and initiate unauthorized withdrawals.
In its official statement, Binance emphasized that investigators had found no evidence of private wallet keys being compromised. However, the exact circumstances surrounding the incident remain under investigation.
As a precaution, the exchange temporarily suspended deposits and withdrawals, revoked affected access permissions, and brought in cybersecurity specialists and law enforcement agencies.
Binance also reassured customers that their funds would be protected. Any losses would be covered through its Secure Asset Fund for Users (SAFU) and the company’s own financial resources.
The incident affected the global Binance.com platform. Binance.US, a separate exchange serving American customers, confirmed that its operations were unaffected.
North Korean Hackers Suspected of Orchestrating Record Theft
Blockchain analytics firms TRM Labs and Chainalysis have linked the attack to TraderTraitor, a North Korean hacking group previously associated with the massive Bybit breach in February 2025.
Investigators identified similarities in the preparation, movement of stolen funds, and techniques used to conceal their origins. However, the attackers’ identities have not yet been officially confirmed.
Stablecoin issuers played a crucial role in limiting the damage. Tether froze approximately $1.6 billion in USDT, while Circle blocked more than $800 million in USDC associated with the incident.
Ripple and World Liberty Financial also participated in efforts to prevent the stolen assets from being moved.
According to Binance’s latest figures, approximately $3 billion in digital assets have now been frozen.
Nevertheless, a substantial portion of the stolen funds remains outside the exchange’s control. TRM Labs researchers identified more than 18,000 BTC still held by the attackers, raising concerns about potential selling pressure if those holdings begin moving onto exchanges.
The incident has once again raised serious questions about the security of centralized cryptocurrency platforms.
Although Binance has promised to fully compensate affected customers, the breach demonstrates how a single compromised element of internal infrastructure can expose billions of dollars in digital assets.
The ultimate financial impact will depend on how much of the stolen cryptocurrency authorities and industry partners can successfully recover.
