Binance, the world’s largest cryptocurrency exchange, has suffered a major security breach with an estimated financial impact of approximately $6.3 billion, in what could become the biggest cryptocurrency theft on record.
The incident, which occurred on Thursday, October 29, prompted the exchange to temporarily suspend deposits and withdrawals while it conducted security checks and worked with blockchain intelligence firms to trace and recover the affected assets.
In a security update released on Friday, Binance said its preliminary investigation suggested that the incident might have involved a compromised laptop belonging to a DevOps engineer.
According to the exchange, the attacker allegedly used the access gained through the laptop to enter a service container and submit unauthorised withdrawal transactions.
Binance, however, said it had found no evidence that wallet private keys were leaked.
The exchange’s co-CEO, Richard Teng, also described the incident as a complex operation rather than a simple, one-click attack, adding that investigations had not yet established the identity of the individual or group responsible.
Binance disclosed that approximately $3 billion worth of affected assets had been frozen through collaboration with blockchain partners.
The company also assured customers that their funds were safe, promising to cover all losses through its Secure Asset Fund for Users (SAFU) and corporate funds.
Meanwhile, several cryptocurrency intelligence firms have linked the attack to North Korea.
Blockchain analysis firm TRM Labs attributed the incident to TraderTraitor, an alleged North Korean hacking unit, citing similarities between the attack and previous cyber thefts associated with the country.
Another blockchain intelligence firm, Chainalysis, reportedly said it had high confidence that North Korea was behind the incident.
However, Binance has not officially attributed responsibility for the breach to any country or hacking group.
Cryptocurrency tracking firm Pangolin Intelligence also reportedly identified similarities between the incident and previous attacks linked to North Korean hackers.
The investigation has triggered a race among cryptocurrency firms and security partners to freeze the stolen assets before the attackers can move or convert them.
Chainalysis said it was monitoring the movement of affected funds across multiple blockchain networks, including Bitcoin and Ethereum.
The latest incident has drawn comparisons with the February 2025 attack on Bybit, another major cryptocurrency exchange, in which hackers stole approximately $1.5 billion.
North Korean-linked hacking groups have repeatedly been accused by international authorities and cybersecurity firms of targeting banks and cryptocurrency platforms to generate revenue for the heavily sanctioned country.
If the latest attribution is confirmed, the Binance incident would further highlight the growing threat posed by sophisticated cybercriminal networks to the global cryptocurrency industry.
Binance was founded in 2017 by Changpeng Zhao and rapidly grew into the world’s largest cryptocurrency trading platform.
Zhao stepped down as the company’s chief executive in 2023 after pleading guilty to violating United States anti-money laundering laws. He was later sentenced to four months in prison and pardoned by US President Donald Trump in October 2025.
