Binance says about $6.3 billion in cryptocurrency was stolen from its wallets on Thursday, 29 October, in the largest crypto theft on record. Blockchain analytics firm TRM Labs put the figure at $6.36 billion across ten blockchains, with most of the money moved in about 20 minutes starting at 20:05 UTC, or 4:05 p.m. Eastern time.
Binance, the largest exchange in the world by trading volume, first said a compromised DevOps engineer’s laptop may have let an attacker reach a service container and submit unauthorized withdrawal transactions. “We have found no evidence of any wallet private key leak,” the company said in its early statement. It later said its investigation had found additional points of breach, and co-chief executive Richard Teng said the attack was more complex than a compromise of a single employee’s permissions.
“The attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual,” Teng said. The company has promised a technical post mortem and an updated proof of reserves, and Binance says it will cover all losses from its SAFU fund and company funds. User funds are safe, the company said.
Binance wallets drained across ten blockchains
TRM Labs said wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and five other networks sent balances to addresses controlled by one attacker. On Ethereum, the attacker used EIP-7702 to turn a hot wallet into a sweeper controlled by the attacker, according to The Block.
The scale dwarfs the previous record. The $1.5 billion theft from Bybit in February 2025 held the record until now. TRM Labs counted $2.9 billion stolen across nearly 150 attacks in all of last year, so this single theft is more than double that annual total. Arkham, another analytics firm, put the theft a little lower, at $6.01 billion, and estimated that about $2.9 billion could still be moved.
The attacker also raced freezes by selling USDT to market makers and borrowing ether against USDT on Aave, according to BleepingComputer. It now holds more than 420,000 ether and 18,270 bitcoin, about $2.4 billion in assets beyond any issuer’s reach, the same report said.
Binance points to North Korea-linked TraderTraitor group
TRM Labs and Chainalysis attributed the attack to TraderTraitor, a North Korean state sponsored hacking group also tracked as Lazarus Group and APT38. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on strong on and off-chain intelligence. We make this judgment with high confidence,” TRM Labs said. Chainalysis chief executive Jonathan Levin said his firm also assessed TraderTraitor as the likely culprit, citing links to earlier attacks.
The attribution comes from analysts, not from the exchange or any government. Binance has not named a hacking group. North Korea’s mission in Geneva and its embassy in China did not respond to Reuters requests for comment. Chainalysis also found links between funds stolen in this attack and proceeds from an exploit at Bitget last month, which was also attributed to North Korean hackers, according to The Block.
The FBI named TraderTraitor as responsible for the $1.5 billion Bybit theft in February 2025. TRM Labs said this attack shares traits with the Bybit heist and with a KelpDAO hack from April 2026. If the attribution holds, this would be the group’s biggest theft yet, and the largest crypto theft ever recorded.
Binance pauses withdrawals and freezes $3 billion
About $3 billion has been frozen on chain, with partners including Tether, Circle, Ripple, World Liberty and Paxos, according to a summary of the company’s update. Binance has suspended deposits and withdrawals while it conducts security checks, revoked authorizations for the affected address, and is working with blockchain intelligence partners and law enforcement to trace and recover the stolen funds.
Binance says it expects to resume withdrawals within about two days, after a security revamp of its withdrawal service. It has about $5 billion in affected assets, with another $1.3 billion being acquired through market and over the counter channels as part of its commitment to cover losses, The Block reported.
What remains unclear is how the attacker reached so many wallets so quickly, and whether the compromised laptop was the entry point or one step in a longer intrusion. Binance said its later investigation found more points of breach, but it has not yet published the full account. That account, when it appears, will be the main test of how Binance could lose $6.3 billion in 20 minutes, and of what other exchanges need to change in their own withdrawal systems.