Binance, a leading cryptocurrency exchange, has been hit by a significant security breach, with approximately $6.3 billion in digital assets transferred from wallets controlled by the exchange. The incident, which occurred on October 29, has raised questions about the security of cryptocurrency exchanges and the effectiveness of internal controls. According to blockchain intelligence firm TRM Labs, the attacker began preparing at least 36 hours before the main transfers, which involved multiple blockchain networks, including Ethereum, Bitcoin, and TRON.
The attack involved unauthorized transactions from Binance's own infrastructure, with the transfers taking place between 20:04 and 23:56 UTC on October 29. TRM Labs identified approximately $6.36 billion in movements across ten networks, with Ethereum accounting for the largest share. The scale of the transfers became apparent as blockchain observers began tracking suspicious movements from Binance wallets, prompting the exchange to acknowledge a security incident and temporarily suspend deposits and withdrawals.
Binance's initial investigation points to a compromised laptop belonging to a DevOps engineer, which was used to submit unauthorized withdrawal transactions. The company says it has found no evidence that wallet private keys were leaked, but has yet to publish a complete technical post-mortem explaining how the attacker gained access to the withdrawal infrastructure. The incident presents an uncomfortable irony for Binance, which had recently highlighted its role in an international crackdown on online scam networks.
In response to the breach, cryptocurrency companies and blockchain investigators moved to stop the assets from being moved further. Binance reported approximately $3 billion in assets frozen on-chain, while TRM Labs' independent analysis put the amount frozen or otherwise intercepted at approximately $2.7 billion. The intervention involved Tether, Circle, Ripple, and other participants, highlighting the importance of cooperation between cryptocurrency companies in responding to security incidents.
The recovery operation has been complicated by the use of decentralized exchanges and lending protocols, which has made it harder to recover the remaining funds. Blockchain analysis firm Bitquery reported that approximately $729 million in stolen stablecoins had been exchanged before freezes took effect, with some funds converted into Ether and TRON. The attacker was also reported to have used stolen stablecoins as collateral to borrow Ether.
TRM Labs and Chainalysis have attributed the incident to TraderTraitor, a North Korean hacking group, with high confidence. The assessment is based on similarities with previous operations, the preparation involved, and the movement of funds after the theft. If confirmed, the incident would reinforce concerns about North Korea-linked cyber operations targeting cryptocurrency infrastructure.
The Binance incident is substantially larger than the $1.5 billion Bybit theft, making it the largest publicly identified single cryptocurrency theft by gross value. However, the $6.3 billion estimate does not represent a confirmed final loss, and the amount that can ultimately be recovered remains unknown. Binance has said it expects to resume withdrawals within 48 hours, subject to security checks, and has promised to cover losses through its Secure Asset Fund for Users (SAFU) and its own funds.
Key points
- The Binance breach is one of the largest cryptocurrency security incidents ever recorded.
- The incident has raised questions about the security of cryptocurrency exchanges and the effectiveness of internal controls.
- The recovery operation has involved cooperation between cryptocurrency companies and blockchain investigators.
