The Binance crypto hack has raised serious questions about the security of the world’s largest cryptocurrency exchange after suspicious transactions involving an estimated $6.3 billion in digital assets were reported on October 29. The company is investigating the incident, while blockchain analysts are tracing the affected funds and examining possible links to North Korean hackers.
If confirmed as a theft of this scale, the incident would far exceed the February 2025 attack on cryptocurrency exchange Bybit, in which approximately $1.5 billion in digital assets was stolen.
How the alleged attack unfolded
Preliminary findings cited by Binance suggest that the attack may have originated from a compromised laptop belonging to a DevOps engineer. The attacker allegedly used the access to enter a service environment and submit unauthorised withdrawal transactions.
Blockchain analysis indicates that suspicious transfers began on October 29 and affected wallets across multiple networks. TRM Labs estimates that approximately $6.36 billion in assets left Binance-controlled wallets across ten blockchains.
Binance has said it has found no evidence that the private keys controlling its digital wallets were leaked. Investigators are examining how the transactions were authorised and whether internal systems or procedures were compromised.
Billions in cryptocurrency frozen
The response from cryptocurrency companies and digital asset issuers has focused on identifying and freezing funds associated with the incident.
Tether reported freezing approximately $1.57 billion in USDT, while Circle froze more than $800 million in USDC linked to the suspected attack. Other industry participants have also taken action to restrict the movement of affected assets.
Binance initially reported that approximately $3 billion in affected assets had been located or frozen, although figures have varied as investigations have progressed.
Freezing cryptocurrency does not automatically mean that the funds have been returned to Binance. The action can, however, prevent certain assets from being transferred or spent, depending on the cryptocurrency and the controls available to its issuer or network.
Investigators examine possible North Korean links
Blockchain analytics firm TRM Labs has attributed the attack to TraderTraitor, a hacking group linked to North Korea, with what it describes as a high degree of confidence. The assessment is based on on-chain and off-chain intelligence, according to the company.
The group has been associated with major cryptocurrency thefts, including attacks attributed to North Korean cyber actors. However, the attribution remains an assessment by investigators rather than a publicly confirmed identification of the perpetrators by Binance.
North Korean-linked hacking groups have repeatedly been accused by international authorities of targeting cryptocurrency platforms and other digital asset businesses.
What happens to users’ funds?
Binance has said it will cover losses arising from the incident and has indicated that user funds remain safe. The company has also temporarily suspended deposits and withdrawals on affected networks while conducting security checks.
The exchange has pointed to its Secure Asset Fund for Users (SAFU), a fund designed to provide an additional layer of protection for users, alongside company resources.
Binance has also committed to providing further information about its reserves and the technical circumstances of the incident as the investigation progresses. The full extent of the losses and the recovery of affected assets remain subject to ongoing verification.
Bitcoin and cryptocurrency markets react
News of the suspected breach triggered volatility across cryptocurrency markets.
Bitcoin fell to approximately $76,470, reaching a six-week low, while Ethereum dropped by more than 3%. Shares in companies exposed to the digital asset market, including Coinbase and Strategy, also came under pressure.
The incident has renewed concerns about the risks associated with holding large amounts of digital assets on centralised exchanges, even when those platforms operate sophisticated security systems.
Investigations are continuing as blockchain analysts trace the transfers and industry participants work to restrict the movement of affected funds. If the reported scale is confirmed, the Binance crypto hack would become the largest cryptocurrency theft on record.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete. As an immediate precaution, Binance has: – temporarily suspended deposits and withdrawals while security checks are completed; – revoked the affected address authorisation; – engaged law enforcement and blockchain intelligence partners to trace and recover funds. Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice. Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions. https://t.co/ywB2mKFy0p
— Binance (@binance) October 30, 2026
Also read: DHS data breach exposes details of 41,000 US immigration agents
For more videos and updates, check out our YouTube channel
