Binance, the world's largest cryptocurrency exchange, has suffered what investigators describe as the biggest cryptocurrency theft in history, with approximately US$6.3 billion reportedly stolen in an attack attributed to North Korean hackers.
According to blockchain intelligence firm TRM Labs, attackers transferred approximately $6.36 billion from Binance wallets across ten blockchains on October 29, with most of the funds moved in just 20 minutes.
TRM attributed the operation with "high confidence" to TraderTraitor, a North Korean hacking unit previously implicated in major cryptocurrency thefts. The FBI previously attributed the February 2025 theft of $1.5 billion from cryptocurrency exchange Bybit to the same group.
Chainalysis also identified TraderTraitor as the likely perpetrator, while blockchain investigator ZachXBT traced stolen funds from Binance and September's Bitget hack to the same cryptocurrency wallet, suggesting a possible connection between the operations.
In an October 30 statement, Binance said its preliminary investigation suggested attackers may have compromised a DevOps engineer's laptop, gaining access to internal systems and enabling unauthorised withdrawals. The exchange later reported identifying additional points of compromise, suggesting the breach extended beyond the initial intrusion.
Binance said investigators had found no evidence that wallet private keys were leaked. The precise method of intrusion remains under investigation.
The exchange confirmed that approximately $3 billion in stolen assets had been frozen with assistance from blockchain partners and cryptocurrency issuers. However, freezing assets does not necessarily mean they have been recovered.
Among the stolen funds were approximately 18,270 bitcoin, worth around $1.4 billion, which attackers distributed across 19 wallets, according to CoinDesk.
Binance temporarily suspended withdrawals while strengthening its security systems. Deposits are operating normally, while the exchange said on October 30 that it expected withdrawals to begin resuming within 48 hours.
The company has pledged to reimburse all losses using its Secure Asset Fund for Users (SAFU) and corporate funds, while promising a detailed investigation report and updated proof of reserves.
The unprecedented theft raises serious questions about security controls at centralised cryptocurrency exchanges and the growing financial threat posed by suspected state-sponsored hacking operations.
