Binance Hit by $6.3 Billion Hack as North Korea Is Suspected

By Suad Seferi · 30 October 2026 at 09:32

Cryptocurrency exchange Binance has reported a major security breach involving approximately $6.3 billion in digital assets, in what could become the largest cryptocurrency theft ever recorded. The attack occurred on October 29, with blockchain investigators tracing unauthorised transfers across multiple networks and identifying a suspected connection to North Korean hackers. In an official security update published on October 30, Binance confirmed that approximately $3 billion in affected assets had already been frozen through cooperation with blockchain companies and industry partners. The exchange said it would cover customer losses using its Secure Asset Fund for Users (SAFU) and company funds. Deposits and withdrawals were temporarily suspended while security teams investigated the breach. The incident has raised serious questions about how attackers managed to authorise billions of dollars in transactions without necessarily obtaining the private keys controlling the exchange's cryptocurrency wallets. How Did the Binance Hack Happen? Binance's preliminary investigation suggests the attack may have originated from a compromised laptop belonging to a DevOps engineer. According to the exchange, the attacker appears to have gained access to an internal service container, allowing unauthorised withdrawal transactions to be submitted. Binance said investigators had found no evidence of wallet private keys being leaked. However, the company has not yet published a complete technical explanation of the incident. The distinction is important. Cryptocurrency theft does not always require attackers to steal a wallet's private key directly. If criminals compromise the systems responsible for authorising transactions, they may be able to initiate transfers that appear technically valid. Blockchain intelligence company TRM Labs published an investigation tracing approximately $6.36 billion in unauthorised transfers across ten blockchain networks. According to TRM, most of the assets were transferred within approximately 20 minutes, beginning at 20:05 UTC on October 29. The affected networks included Ethereum, Bitcoin, Tron, Solana and the XRP Ledger, among others. TRM's analysis indicates that the attacker may have compromised the infrastructure Binance uses to authorise cryptocurrency withdrawals across multiple blockchains. On Ethereum, investigators identified the use of EIP-7702, a mechanism that allows an externally owned wallet to delegate execution to smart contract code. According to TRM, the attacker used previously signed authorisations to take control of a Binance hot wallet's behaviour and transfer assets. These technical findings remain part of an ongoing investigation. Binance has not yet confirmed the complete attack sequence. North Korean Hacking Group Suspected TRM Labs has attributed the attack to TraderTraitor, a North Korean state-sponsored hacking operation, expressing high confidence in its assessment. The researchers identified similarities with previous attacks linked to the group, including advance preparation, suspicious transaction patterns and techniques used to move stolen cryptocurrency. TraderTraitor has previously been connected to major cryptocurrency thefts. In February 2025, the US Federal Bureau of Investigation confirmed that North Korean actors associated with TraderTraitor were responsible for stealing approximately $1.5 billion from cryptocurrency exchange Bybit. The Binance incident is potentially more than four times larger. However, the attribution to North Korea in the latest incident remains TRM Labs' assessment. Binance has not publicly confirmed the attackers' identities, and no official law enforcement attribution for this breach has been established. Billions Frozen, but Not All Funds Recovered One of the most significant developments following the attack was the rapid freezing of cryptocurrency assets. Stablecoin issuers and blockchain organisations moved to prevent attackers from transferring or exchanging portions of the affected funds. According to TRM Labs, approximately $2.7 billion had been frozen by early October 30, including assets associated with Tether, Circle, Ripple, World Liberty Financial and the Arbitrum network. Binance subsequently reported that approximately $3 billion had been frozen on-chain. The distinction between freezing and recovering cryptocurrency is important. Frozen assets may remain at addresses controlled by attackers, but restrictions imposed by token issuers can prevent those assets from being transferred. This does not necessarily mean the cryptocurrency has already been returned to Binance. Other assets, including Bitcoin and Ether, cannot be frozen through the same mechanisms used by centralised stablecoin issuers. TRM reported that the attackers had already converted some affected stablecoins into other cryptocurrencies, complicating efforts to recover the remaining funds. The final financial impact will depend on how much cryptocurrency investigators can recover and how much Binance ultimately needs to cover using its reserves and company funds. What Does This Mean for Binance Users? Binance has stated that customer funds remain safe and that the company will cover losses related to the incident. The exchange temporarily suspended deposits and withdrawals, revoked affected wallet authorisations and began working with law enforcement and blockchain intelligence partners. Binance also committed to publishing an updated Proof of Reserves following remediation, alongside a detailed technical report explaining the breach. For users, the immediate concern is the availability of exchange services and the effectiveness of the company's recovery measures. Customers should monitor Binance's official communications and avoid unsolicited messages claiming to provide compensation, account recovery assistance or emergency security verification. Major security incidents frequently create opportunities for secondary fraud,…