Binance said on October 30 that a security breach had affected an estimated $6.3 billion in cryptocurrency assets, in what security researchers describe as potentially the largest crypto theft on record. The exchange has frozen about $3 billion on-chain and temporarily suspended withdrawals while it completes security checks and traces the remaining funds.

The company said its initial investigation points to a compromised DevOps engineer’s laptop, which allegedly allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Binance later said investigators had identified additional points of breach, indicating that the incident was more complex than a single compromised device.

What Binance has confirmed

Binance said there is no evidence that wallet private keys were leaked. It revoked authorization for the affected addresses, engaged law enforcement and blockchain-intelligence partners, and said deposits continue to operate normally.

  • Estimated total impact: about $6.3 billion.
  • Assets frozen on-chain: approximately $3 billion.
  • Withdrawals: temporarily suspended while the withdrawal service and related addresses undergo a security review.
  • Deposits: operating normally, according to Binance’s October 30 update.
  • Loss coverage: Binance said it will cover all losses through the SAFU emergency fund and company funds.
  • Private keys: no evidence of a wallet private-key leak, according to the company.

Binance co-CEO Yi He said the platform would cover “all hacking losses.”

How the attack unfolded

Blockchain-analytics firm Arkham estimated that about $6.01 billion was taken from Binance hot wallets across nine blockchains between 4:10 p.m. and 7:05 p.m. ET on October 29. Its data indicated that issuers had frozen $2.80 billion, while roughly $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens could still be moved.

Reuters reported that at least $5.912 billion was stolen and moved across multiple networks, including Bitcoin, Ethereum, Tron, Ripple and several Layer 2 chains. The bulk of the transfers occurred in roughly 20 minutes, according to reporting citing blockchain-analysis firms.

Binance said Binance Alpha trading was temporarily suspended. The company also said the verified total frozen stood at $2.54 billion at one point on October 30, before later communications cited approximately $3 billion frozen on-chain.

Attribution and response

Binance has not publicly identified a culprit. However, blockchain-intelligence firms TRM Labs and Chainalysis have attributed the operation to North Korean hackers, with TRM Labs describing it as the largest hack in history.

The United States Secret Service said it is working with partners to help track the stolen funds. Binance said it is cooperating with law enforcement and industry partners to trace and recover assets.

Operational impact

The breach prompted Binance to halt withdrawals and suspend Binance Alpha trading, disrupting access to funds for users while the investigation continues. The company said it expects withdrawal services to resume within about 45 to 48 hours, with later reporting indicating a target of Sunday morning.

Cryptocurrency prices declined following the disclosure, according to Reuters. The incident is likely to intensify scrutiny of exchange custody practices, withdrawal controls, endpoint security, and the speed with which stablecoin issuers and blockchain networks can freeze illicit transfers.

What remains unclear

  • The precise amount ultimately lost after freezes, recoveries, and further tracing.
  • The full set of breach points identified during the ongoing investigation.
  • Whether the suspected North Korean attribution will be confirmed by Binance or law-enforcement agencies.
  • The final timeline for restoring withdrawals and completing the security overhaul.

Sources and further reading: