Hackers have withdrawn around $6.3 billion in crypto assets from Binance in the largest known theft in the history of the sector. Analyst firm TRM Labs has linked the attack with a high degree of confidence to TraderTraitor – a hacking group that the company says is backed by North Korea. No government agency has yet officially claimed responsibility for the attack.
According to TRM Labs, around $6.36 billion left Binance wallets across 10 blockchain networks. The bulk of the funds were transferred in approximately 20 minutes, starting at 20:05 UTC on October 29. The estimate makes the incident about four times larger than the $1.5 billion theft from crypto exchange Bybit in February 2025.
Compromised laptop is the possible entry point
Binance said that initial investigation points to a compromised laptop belonging to a DevOps engineer - a specialist who maintains and automates technology infrastructure. From there, the attacker likely gained access to a service container and submitted unauthorized withdrawal transactions.
The exchange stressed that it did not find any evidence of a private key leak. After the attack was detected, the affected addresses were revoked, withdrawals were temporarily suspended on several networks, and law enforcement and blockchain transaction analysis companies were involved.
Some of the funds have been frozen
Binance reports that about $3 billion in affected assets have been frozen on-chain. TRM Labs estimates the amount at approximately $2.7 billion, citing actions by stablecoin issuers Tether, Circle, Ripple, and World Liberty Financial, as well as the Arbitrum Network Security Council. The difference is due to the different timing and method of calculation.
According to TRM Labs, the attacker still controls about $2.4 billion in assets, including over 420,000 ether and 18,270 bitcoins - cryptocurrencies that cannot be frozen by a central issuer. The company expects the funds to be traceable in future attempts to exchange, transfer across blockchain bridges, or sell through OTC brokers.
Binance promises to cover losses
The exchange says that user funds are protected and that it will cover financial losses through the Secure Asset Fund for Users (SAFU) and its own funds. Binance also said that it has over $6.34 billion to recover the stolen assets and that more than $5 billion has already been secured in the form of other cryptocurrencies.
TRM Labs points out similarities between the attack on Binance and previous operations attributed to TraderTraitor, including the theft from Bybit and the attack on KelpDAO. These include pre-priming wallets, using small transactions to fund the operation, and transferring large amounts in a short period of time.
The investigation is ongoing, and Binance says it will publish a detailed technical analysis once it determines the final cause of the breach.
Sources: apnews.com, fidelity.com, theguardian.com