SAN FRANCISCO, USA — Cryptocurrency exchange Binance has suffered a major security breach after attackers transferred approximately $6.3 billion in digital assets from its wallets on October 29, 2026. The incident is potentially the largest cryptocurrency theft on record.
According to blockchain analysis firm TRM Labs, approximately $6.36 billion was moved across 10 blockchains, with most of the transfers occurring within roughly 20 minutes. Binance temporarily suspended withdrawals following the incident and said it would cover all customer losses using its Secure Asset Fund for Users (SAFU) and corporate resources.
How the Attack Unfolded
Binance’s initial investigation indicated that attackers gained access through a compromised laptop belonging to a DevOps engineer. The access allowed them to reach a service container and submit unauthorized withdrawal transactions.
However, the investigation later identified additional points of breach, indicating that the attack involved more than a single compromised device.
The affected wallets were used to process customer withdrawals across several blockchain networks, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger.
Binance said it found no evidence that wallet private keys had been leaked.
North Korean Hackers Suspected
Blockchain intelligence firms TRM Labs and Chainalysis have linked the attack to TraderTraitor, a North Korean hacking unit associated with the Lazarus Group.
TRM Labs assessed the attribution with high confidence, citing on-chain and off-chain intelligence. Analysts also identified similarities with previous North Korea-linked cryptocurrency thefts.
In February 2025, TraderTraitor was linked to the $1.5 billion Bybit exchange hack, which had previously been the largest recorded cryptocurrency theft.
Binance has not publicly identified the attackers and is cooperating with law enforcement agencies to investigate the incident.
Financial Impact and Recovery Efforts
Binance said it has worked with blockchain partners to freeze approximately $3 billion of the stolen assets.
The recovery efforts include:
-
Tether: Nearly $1.57 billion in USDT frozen.
-
Circle: More than $800 million in USDC frozen.
-
Other partners: Additional assets frozen through cooperation with Ripple, World Liberty Financial and other blockchain networks.
The remaining assets, including Bitcoin and Ether, are more difficult to freeze directly. Investigators are continuing to trace the funds and identify the individuals responsible.
Binance has pledged to cover all customer losses through its Secure Asset Fund for Users (SAFU) and corporate reserves. The exchange said it has reserved more than $6.34 billion for this purpose.
Former CEO Changpeng Zhao also said that customer funds would be covered.
Withdrawal Suspension and Market Reaction
Following the incident, Binance temporarily suspended withdrawals while conducting security reviews and upgrading its withdrawal systems. Deposits later resumed, while withdrawals remained paused.
The exchange expected to restore withdrawal services within approximately 45 to 48 hours.
The incident also affected cryptocurrency markets. Bitcoin fell from the $80,000–$82,000 range to approximately $76,000–$77,000, while other major cryptocurrencies also recorded declines. Market liquidations reached approximately $1.5 billion over a 24-hour period.
Binance continues to work with blockchain analytics firms and law enforcement agencies to investigate the breach and recover the stolen assets. The exchange also plans to publish an updated Proof of Reserves after completing its remediation efforts.
——— End of Article ———