Binance, the world’s largest cryptocurrency exchange, has suffered a major security breach after hackers allegedly stole approximately $6.3 billion worth of digital assets in what blockchain analysts are describing as the largest cryptocurrency theft on record.
The attack, which occurred on October 29, 2026, involved unauthorised withdrawals from Binance wallets across multiple blockchain networks. The exchange subsequently suspended withdrawals while its security teams and blockchain intelligence partners worked to contain the incident and trace the stolen funds.
Investigators have pointed towards North Korea’s notorious hacking operations as the suspected perpetrators. Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, an elite North Korean hacking unit, based on what it described as strong on-chain and off-chain intelligence.
Binance, however, has not officially identified those responsible.
The exchange has assured customers that their funds are safe and promised to absorb the financial losses using its emergency protection fund and corporate treasury.
Here are seven important facts about the record-breaking Binance cryptocurrency heist.
READ ALSO: Banky W Returns to Music: 7 Exciting Facts About His Victor Thompson Collaboration
1. Hackers Stole Approximately $6.3 Billion From Binance
The attack happened on October 29, when billions of dollars in digital assets were transferred from wallets belonging to Binance to addresses controlled by an attacker.
According to TRM Labs, approximately $6.36 billion worth of cryptocurrency was taken across 10 blockchain networks, making it the largest crypto theft recorded.
The stolen assets included Bitcoin, Ethereum, USDT, USDC, XRP, Solana and other digital currencies.
Most of the money reportedly moved within approximately 20 minutes, although additional transactions followed over the next several hours.
The scale of the theft has raised fresh questions about the security of cryptocurrency exchanges, particularly platforms responsible for holding large amounts of customers’ digital assets.
TRM Labs says the incident is approximately four times larger than the $1.5 billion Bybit hack recorded in February 2025.
Read the TRM Labs investigation into the Binance hack.
2. North Korea’s TraderTraitor Is Suspected of Carrying Out the Attack
One of the biggest questions surrounding the incident is who was responsible.
Blockchain intelligence firm TRM Labs has attributed the attack to TraderTraitor, a North Korean hacking unit associated with previous major cryptocurrency thefts.
The company said its assessment was based on a combination of blockchain activity and intelligence gathered from earlier incidents.
Another blockchain intelligence firm, Pangolin Intelligence, also reportedly identified similarities between the Binance attack and previous operations linked to North Korean hackers.
Chainalysis has also said it has high confidence that North Korea was behind the incident.
However, Binance has not confirmed the identity of the attackers, and no government attribution has been established in the information available at the time of publication.
North Korea has previously been accused of using sophisticated cyber operations to steal cryptocurrency and generate revenue for the country.
3. The Attack May Have Started With a Compromised Engineer’s Laptop
Binance’s initial investigation suggested that the hackers may have gained access through a compromised laptop belonging to a DevOps engineer.
According to the exchange, the attacker allegedly used the compromised device to access a service container and submit unauthorised withdrawal transactions.
However, Binance’s subsequent investigation uncovered additional possible points of breach, and the company has not yet published a complete technical explanation.
The exchange also stated that it had found no evidence that wallet private keys were leaked.
This distinction is important because the incident appears to involve weaknesses in the systems used to authorise transactions rather than confirmed exposure of the private keys themselves.
Binance has promised to release a detailed technical report after completing its investigation.
4. About $3 Billion of the Stolen Cryptocurrency Has Been Frozen
Following the attack, cryptocurrency companies and blockchain security partners moved quickly to trace and freeze the stolen assets.
Binance’s October 30 security update said approximately $3 billion worth of affected assets had been frozen on-chain.
TRM Labs separately estimated that approximately $2.7 billion had been frozen through actions involving stablecoin issuers and blockchain security partners.
Companies involved in the response reportedly included Tether, Circle and Ripple, alongside other industry partners.
Freezing digital assets can prevent attackers from transferring or spending certain tokens, particularly stablecoins issued by companies with the technical ability to blacklist specific wallet addresses.
However, not all cryptocurrencies can be frozen in the same way.
TRM Labs estimated that the attacker still controlled approximately $2.4 billion in assets, including substantial amounts of Ethereum and Bitcoin, that were beyond the reach of those issuer-controlled freezes at the time of its report.
The race to trace and recover the remaining funds is continuing.
5. Binance Suspended Withdrawals but Promised to Protect Customers
Following the discovery of the breach, Binance temporarily suspended withdrawals while carrying out security checks and strengthening affected systems.
The exchange said the suspension was necessary to prevent further unauthorised transactions and give investigators time to examine the compromised infrastructure.
In its October 30 update, Binance confirmed that deposits and other unaffected platform services remained operational.
The company also reassured customers that they would not bear the financial consequences of the incident.
Binance said it would cover the stolen funds through its Secure Asset Fund for Users (SAFU) and corporate treasury.
According to its latest security update, the company had set aside more than $6.34 billion in company funds, including assets matching the types of cryptocurrency stolen.
The exchange said it was working towards restoring withdrawals in phases after completing the necessary security checks.
Customers should rely on Binance’s official security updates rather than unofficial social media messages claiming to offer recovery services.
6. The Attack Is Bigger Than the Previous Bybit Crypto Heist
The Binance incident has overtaken the February 2025 Bybit hack as the largest cryptocurrency theft reported to date.
In the Bybit incident, hackers stole approximately $1.5 billion worth of digital assets. Investigators attributed that attack to North Korean-linked hackers.
The Binance theft is more than four times that amount, according to TRM Labs’ valuation.
The two incidents have renewed concerns about the ability of sophisticated hacking groups to target major cryptocurrency platforms.
North Korean-linked cyber operations have been associated with several large-scale financial and cryptocurrency thefts over the years.
According to TRM Labs, the country has stolen approximately $12.8 billion in cryptocurrency across multiple incidents since 2017, with a significant portion of that amount attributed to 2026 activity.
The figures highlight the growing importance of cybersecurity and international cooperation in protecting digital financial systems.
7. Binance Co-Founder Changpeng Zhao Responds to the Crisis
The incident has also brought renewed attention to Binance co-founder Changpeng Zhao, widely known as CZ.
Zhao co-founded Binance in 2017, helping it become the world’s largest cryptocurrency trading platform by trading volume.
He stepped down as chief executive in 2023 after pleading guilty in the United States to violating anti-money laundering requirements. He was sentenced to four months in prison and later received a presidential pardon in October 2025.
Although Zhao no longer manages the exchange, he remains its largest shareholder.
Following the security breach, he publicly expressed confidence that Binance would cover the losses and protect customer funds.
The exchange’s current leadership, including co-CEOs Richard Teng and Yi He, has also reiterated its commitment to absorbing the financial impact.
The incident now presents a major test of the company’s security systems, financial resources and ability to maintain customer confidence.
What Happens Next?
The investigation into the Binance hack remains ongoing.
The immediate priorities include restoring withdrawal services safely, recovering as much of the stolen cryptocurrency as possible, identifying those responsible and publishing a detailed technical explanation of how the attack happened.
The exchange has also promised an updated Proof of Reserves report to provide customers with further information about the assets backing their account balances.
Although Binance has promised to cover the losses, the incident is likely to intensify discussions about cryptocurrency exchange security and the risks associated with keeping digital assets on centralised trading platforms.
For now, the biggest question remains whether investigators and their partners can recover the billions of dollars still under the attacker’s control.
If TRM Labs’ attribution is confirmed, the incident would represent another major cryptocurrency theft linked to North Korean hacking operations.
