Binance, the world's largest cryptocurrency exchange, has confirmed a massive security breach resulting in the theft of approximately $6.36 billion in digital assets. The incident, which occurred on October 29, involved the unauthorized transfer of funds across ten different blockchains. Blockchain intelligence firm TRM Labs reported that the majority of the stolen capital was moved within a 20-minute window, marking the largest crypto heist in history.
Initial investigations by the exchange pointed to a compromised laptop belonging to a DevOps engineer, which allegedly provided attackers access to a service container used to submit unauthorized withdrawal transactions. However, Binance has since clarified that the incident was a more complex operation involving multiple points of breach rather than a single point of failure. The company explicitly stated that it has found no evidence that wallet private keys were leaked during the attack.
In response to the theft, Binance has collaborated with various blockchain partners to freeze approximately $3 billion of the affected assets. The exchange has committed to covering all remaining losses using its emergency fund and company capital. While deposits have resumed, the platform temporarily suspended withdrawals following the breach, with the company indicating that it expects to restore full withdrawal functionality within a few days.
Security analysts, including those at TRM Labs and Elliptic, have attributed the attack to the North Korean hacking unit known as TraderTraitor. Evidence suggests the attackers conducted significant preparation, including funding a wallet through small, incremental withdrawals from the privacy service Tornado Cash and rehearsing the execution of previously signed transactions. This heist significantly exceeds the scale of previous major crypto thefts, including the $1.5 billion Bybit incident from February 2025.
Binance has advised its users to remain vigilant against secondary threats, specifically warning against phishing attempts and fraudulent recovery services that may emerge in the wake of the news. The exchange emphasized that users should only rely on official communication channels and avoid interacting with unsolicited messages claiming to offer account verification or compensation. The company plans to release a comprehensive technical report once its internal investigation concludes.