Binance says roughly $6.3 billion was affected by a security incident at the exchange. If that figure is confirmed, it’s the biggest theft in crypto’s history, more than four times the previous record: the approximately $1.5 billion stolen from Bybit in February 2025.
The investigation at the world’s largest crypto exchange is ongoing. What’s known so far traces back to a single compromised laptop.
10 blockchains in about 20 minutes
According to blockchain analytics firm TRM Labs, the attackers drained about $6.36 billion from Binance wallets spread across 10 separate blockchain networks. The bulk of the transactions were completed within roughly 20 minutes.
Trouble first surfaced on October 29, when suspicious transfers started flowing out of Binance wallets on Ethereum, Bitcoin and TRON. Initial estimates pegged the outflows at around $5.7 billion, with about $1.45 billion of that in Bitcoin and $875 million in Ethereum. The figure grew after that.
A compromised DevOps laptop, with no key leak found
Binance has said little about the method. In a statement, the company said: “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”
The exchange insists its core wallet security held up. “We have found no evidence of any wallet private key leak,” Binance said. It added that it “will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.”
If that’s accurate, it matters. The attackers had no need for the keys once they were inside a system that already had permission to send withdrawals.
About half frozen, nothing returned yet
Binance says it has teamed up with blockchain partners to lock the stolen assets in place. “We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far,” the company said. Tether and Circle are among the firms helping, together with the relevant authorities.
A freeze is not a recovery, though. Binance hasn’t received any of that $3 billion back so far, and the other $3 billion or so is still at large.
The exchange said it revoked authorization for the affected address and has brought in law enforcement and blockchain intelligence partners to follow the funds. “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice,” Binance said.
Is North Korea behind it?
TRM Labs pins the attack on TraderTraitor, a group the firm connects to North Korea. Binance has not officially said who carried it out.
If you hold funds on Binance
Binance says customers won’t bear the cost. “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe,” the company said. Once the cleanup is finished, it plans to release an updated Proof of Reserves.
In its first statement, Binance said deposits and withdrawals were temporarily halted while it ran security checks. The most recent update says deposits are back to normal. Withdrawals remain paused.
For anyone waiting to move money off the platform, Binance advises ignoring any message that doesn’t come straight from the company: “Please rely only on official Binance channels for updates.”