Binance, the world’s largest cryptocurrency exchange by daily trading volume, has suffered a major cyberattack that resulted in the theft of approximately $6.3 billion worth of digital assets, in what analysts have described as potentially the largest cryptocurrency heist on record.
The exchange said it was working with blockchain investigation firms, cryptocurrency platforms and law enforcement agencies to trace and recover the stolen funds.
Following the attack, Binance disclosed that approximately $3 billion of the affected assets had been frozen through collaboration with industry partners, preventing hackers from moving or converting some of the stolen cryptocurrency.
The company also assured customers that it would bear the financial cost of the incident, pledging to cover all losses arising from the security breach.
According to reports by Reuters, the attack occurred on October 29, with most of the stolen funds reportedly transferred within approximately 20 minutes across multiple blockchain networks.
Blockchain intelligence firm TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean-linked hacking group known for targeting cryptocurrency platforms and financial institutions.
In its investigation, TRM Labs said the attackers moved approximately $6.36 billion from Binance-controlled wallets across 10 blockchain networks.
The firm said its attribution was based on both on-chain and off-chain intelligence, as well as similarities with previous cyberattacks associated with North Korean hackers.
Another blockchain analytics company, Chainalysis, also linked the incident to TraderTraitor, citing similarities in the movement of stolen funds and techniques used in previous attacks.
Binance’s initial investigation suggested that the security breach might have involved a compromised laptop belonging to a DevOps engineer. However, the exchange later disclosed that further investigations had uncovered additional points of breach.
The attack reportedly affected the exchange’s hot-wallet infrastructure, which is connected to the internet and facilitates cryptocurrency transactions.
Despite the scale of the incident, Binance maintained that customer deposits were not affected, although withdrawals were temporarily suspended as security checks continued.
In a subsequent update on November 1, Reuters reported that Binance had replaced approximately 95 per cent of the stolen assets, using company funds, its Secure Asset Fund for Users (SAFU), and other financial reserves to restore affected customer balances.
The exchange also began gradually restoring withdrawals for selected cryptocurrencies.
The incident has renewed concerns about cybersecurity vulnerabilities in the cryptocurrency industry, particularly the growing sophistication of cybercriminal networks targeting digital asset platforms.
The FBI has attributed the attack to North Korea’s TraderTraitor group, although US President Donald Trump said the United States was still investigating the country’s alleged involvement.
Share this content:
About The Author
