Crypto exchange Binance has been hit by a security breach worth an estimated $6.3 billion. According to the American blockchain analysis company TRM Labs, the attackers removed about $6.36 billion from the exchange’s wallets across 10 blockchains, with most of the funds being moved in about 20 minutes. TRM Labs links the attack to the North Korean hacking group TraderTraitor with a high degree of confidence.
“The attacker moved approximately $6.36 billion from Binance’s wallets across ten blockchains, with most of the funds being moved in about 20 minutes“, TRM Labs said, quoted by Reuters. The company added that a number of features of the operation are consistent with previous thefts attributed to TraderTraitor, including the attack on the exchange Bybit in February 2025.
How the breach happened
Binance said its initial investigation points to a compromised laptop belonging to a DevOps engineer. From there, the attacker likely gained access to an internal service container and submitted unauthorized withdrawal requests. The exchange said there is no evidence of any wallet private keys being leaked.
A separate analysis by Bitquery tracked the outflow of funds from 17 Binance hot wallets across nine blockchains in less than four hours, between 20:04 and 23:56 GMT on October 29. This does not contradict TRM Labs’ estimate that the initial withdrawal of the bulk of the assets took about 20 minutes, but it suggests that the related transactions took longer.
About $3 billion frozen
Binance said it had frozen about $3 billion of the affected assets in collaboration with blockchain partners. According to Reuters, Tether had frozen about $1.57 billion, and Circle had frozen over $800 million. Bitquery estimated the amount of frozen or immobilized assets at about $2.7 billion, and the remaining funds with the attacker at about $3.2 billion in the early hours of October 30.
Deposits and withdrawals on Binance have been temporarily suspended due to security checks. “User funds are safe,” the exchange said. The company promises to cover all losses through the SAFU fund and with its own funds, and after the investigation is completed, to publish a technical report and updated information about its reserves.
The market reacted with a decline
The news pushed down the prices of major cryptocurrencies. Bitcoin has fallen by about 3.2% to below $79,000. The potential amount of the theft is approximately four times larger than the previous record - about $1.5 billion stolen in the attack on Bybit in February 2025.
Binance has about 335 million registered users worldwide, and according to the exchange's annual report for 2025, it held approximately $162.8 billion in assets under custody. The investigation is ongoing, and so far there has been no official statement from law enforcement confirming the identity of the perpetrators.
Sources: marketscreener.com, apnews.com, bitquery.io