Binance is investigating a $6.3 billion cryptocurrency theft that could be the largest in the industry's history.
The exchange disclosed the incident on Oct. 29 after attackers drained funds from wallets used to process transactions. Binance initially suspected a compromised engineer's laptop, but a subsequent investigation uncovered additional points of compromise.
Industry partners have located or frozen approximately $3 billion in affected assets, while Binance has pledged to cover customer losses through its Secure Asset Fund for Users (SAFU) and corporate resources.
Binance has temporarily suspended withdrawals, while deposits remain unaffected. In a post on X, co-CEO Yi He said the exchange is working to improve its withdrawal services and related address controls, with withdrawals expected to resume within 48 hours.
How the attack happened
Binance says that it initially traced suspected intrusion to a compromised engineer's laptop, which may have allowed attackers to access internal systems. The exchange later reported finding additional points of compromise without providing further technical details.
The suspected entry point highlights why developer workstations can be attractive targets for attackers seeking access to critical systems.
“Binance hasn’t said how the laptop was compromised, but developer machines are under attack daily,” said Mackenzie Jackson, field CTO at Aikido Security.
Jackson explained that compromised developer machines can expose cloud credentials, SSH keys, and access tokens that attackers may use to move through internal systems. However, Binance has not confirmed whether those techniques were involved in this attack.
Blockchain intelligence firm TRM Labs said attackers compromised Binance's transaction-signing infrastructure, enabling unauthorized transfers from affected wallets. According to its analysis, most of the stolen cryptocurrency was moved within approximately 20 minutes.
Binance has not identified the attackers. However, blockchain intelligence firms TRM Labs and Chainalysis have linked the incident to North Korean hackers, citing similarities to previous attacks and the movement of stolen funds.
Chainalysis also reported that proceeds from a previous Bitget breach were being mixed with assets stolen from Binance. The investigation remains ongoing, and Binance has not confirmed the attribution.
Paolo Ardoino, CEO of Tether, shared on X that his company had frozen more than $1.567 billion in funds suspected of being involved in the Binance hack. The Arbitrum Council also shared that it had frozen about $30.8 million in funds linked to the exploit.
Coordinated response limits movement of stolen funds
The Binance incident demonstrates how cooperation among cryptocurrency exchanges, stablecoin issuers, and blockchain security firms can restrict the movement of stolen assets.
Tether, Circle, Ripple, and other organizations moved to freeze cryptocurrency linked to the attack. However, freezing assets does not guarantee their recovery. While stablecoin issuers can block transfers of certain tokens, cryptocurrencies such as bitcoin and ether cannot be frozen in the same way.
The response also comes as investigators examine possible links to North Korean hackers, who have previously targeted cryptocurrency companies through attacks on employees and internal systems.
“This incident is still in the initial ‘fog of war’ phase, and Binance will need to take time to fully investigate how this attack happened. However, initial reports do align with the playbook of the group known as TraderTraitor, a North Korean state-sponsored cluster associated with previous cryptocurrency thefts,” said Rafe Pilling, senior director of threat research at Sophos.
For cryptocurrency exchanges, the incident reinforces the importance of securing developer workstations, restricting access to transaction-signing infrastructure, and coordinating incident response with external partners.
Organizations also need procedures for quickly identifying unauthorized transactions and working with relevant issuers and law enforcement to limit further losses.
The remaining questions are how the attackers gained control of critical systems, how much of the stolen cryptocurrency can be recovered, and when Binance customers will regain normal access to exchange services.
Other news: Cathay Pacific has disclosed a data breach involving travel technology provider Amadeus that exposed information from approximately 53,000 flight bookings.