World-leading cryptocurrency exchange Binance is investigating a massive cyberattack resulting in an estimated $6.3 billion security breach, potentially the largest theft in digital asset history, after a compromised developer's laptop allowed unauthorized access to service containers.
Binance confirmed the scale of the security incident on October 30, saying it had worked with blockchain companies and asset issuers to freeze about US$3 billion of the affected funds.
The world’s largest cryptocurrency exchange said users would not bear losses from the breach.
“Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe,” the company said in an official security update.
Withdrawals were temporarily suspended while Binance carried out security checks and traced the remaining assets.
Compromised Laptop Emerges as Possible Entry Point
Binance said its preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer.
According to the exchange, the attacker was able to gain access to a service container and submit unauthorised withdrawal transactions.
The company stressed, however, that its investigation had found no evidence that cryptocurrency wallet private keys were leaked.
Binance later said the incident appeared more complex than a single compromised employee account and that investigators had uncovered additional points of breach.
A detailed technical report is expected after the investigation is completed.
The exchange has revoked authorisation for affected addresses and brought in law enforcement agencies and blockchain intelligence firms to help identify the attackers and recover funds.
North Korean Group Suspected
Blockchain intelligence firm TRM Labs has attributed the attack with high confidence to TraderTraitor, a hacking unit linked to North Korea.
TRM said approximately US$6.36 billion was moved from Binance wallets across 10 blockchains, including Bitcoin, Ethereum, Tron, Solana and the XRP Ledger.
The firm said much of the theft occurred during a short burst on October 29.
Its investigation found similarities with previous North Korean linked attacks, including the US$1.5 billion Bybit theft in February 2025.
TRM described the Binance incident as roughly four times the size of that attack.
The company said the attacker obtained valid transaction signatures across several blockchain networks, pointing to a possible compromise of Binance’s hot wallet signing infrastructure rather than a simple theft of wallet keys.
Binance itself has not publicly attributed responsibility to North Korea and says law enforcement investigations are continuing.
Billions Frozen, But Large Holdings Remain
Crypto companies moved quickly after the suspicious transfers were detected.
TRM said Tether, Circle, Ripple and World Liberty Financial froze about US$2.67 billion in stablecoins, while emergency action on the Arbitrum network prevented access to another roughly US$30 million.
Binance subsequently placed the verified amount frozen across the ecosystem at about US$3 billion.
TRM estimates that the attacker still controls assets worth roughly US$2.4 billion that cannot simply be frozen by centralised token issuers, including large holdings of Bitcoin and Ether.
That means tracing and recovery efforts could continue for some time as investigators monitor transfers across blockchains, exchanges and decentralised finance platforms.
Largest Crypto Theft on Record
If the current estimates hold, the Binance attack would comfortably exceed the Bybit breach that previously held the record for the largest cryptocurrency theft.
The size of the incident is also likely to renew scrutiny of security arrangements at centralised exchanges that hold large amounts of customer assets in wallets connected to online systems.
Binance has more than 300 million registered users globally and remains the dominant cryptocurrency trading platform by volume.
The exchange said it would publish an updated proof of reserves after its remediation work is completed.
For users, the immediate question is when normal withdrawals will fully resume. For the wider cryptocurrency industry, the harder issue will be how an attacker managed to trigger billions of dollars in authorised transactions across several blockchain networks without obtaining the underlying private keys.
READ ALSO: MTN Ghana Profit Before Tax Jumps 52% to GH¢11.3bn
