Binance is investigating a major security breach involving an estimated $6.3 billion in cryptocurrency, potentially making it the largest theft in the industry's history.
The exchange estimated the financial impact on October 30, saying approximately $3 billion in affected assets had been frozen through coordination with blockchain partners. Binance pledged to cover losses using its Secure Asset Fund for Users (SAFU) and company resources. The investigation remains ongoing.
HOW THE ATTACK HAPPENED
The incident began on October 29, when attackers gained unauthorized access to systems responsible for processing cryptocurrency withdrawals.
Binance's initial investigation pointed to a compromised laptop belonging to a DevOps engineer. According to the exchange, the compromise may have allowed an attacker to access an internal service container and submit unauthorized withdrawal transactions.
Binance says it has found no evidence that wallet private keys were leaked. However, investigators subsequently identified additional points of compromise. Co-CEO Richard Teng emphasized that the incident involved a complex attack rather than the misuse of a single employee's permissions. The full technical sequence has not yet been established.
BINANCE LEADERSHIP ADDRESSES THE BREACH
Binance leadership has publicly addressed the incident, outlining the company's response and its commitment to protecting customer balances. The exchange's official video update is embedded below.
BILLIONS FROZEN ACROSS BLOCKCHAIN NETWORKS
Binance says approximately $3 billion in affected assets has been frozen on-chain. Stablecoin issuers, including Tether and Circle, participated in the response by restricting transfers involving assets linked to the incident.
Freezing cryptocurrency does not necessarily mean recovering it. Issuers of USDT and USDC can restrict transfers involving specific tokens through controls built into their smart contracts. Bitcoin and Ether do not provide equivalent issuer-controlled freezing mechanisms, complicating efforts to contain the remaining assets.
NORTH KOREAN HACKERS SUSPECTED
Blockchain intelligence companies have identified possible connections between the attack and North Korean cybercrime operations. TRM Labs attributes the intrusion to TraderTraitor, a hacking operation associated with North Korea; other investigators identified similarities to previous large-scale cryptocurrency thefts.
The assessment has not been independently confirmed by law enforcement. Binance has not publicly identified the perpetrators and says it is cooperating with authorities and blockchain investigators to trace the funds.
BINANCE PLEDGES TO COVER CUSTOMER LOSSES
Binance says it will absorb the financial impact rather than pass losses to customers, using SAFU reserves and corporate funds to restore affected balances.
In an October 30 update reported by CoinDesk, Binance said it had allocated more than $6.34 billion in company resources to address the incident. The exchange temporarily suspended deposits and withdrawals while conducting security checks, revoked affected authorizations and began reviewing its withdrawal infrastructure. Deposits have since resumed, while withdrawals remain subject to security checks.
An updated Proof of Reserves is expected following remediation. The company's commitments are public, but the full recovery process has not yet been completed.
THE CUSTODY PROBLEM
The breach raises questions extending beyond Binance. Cryptocurrency held on centralized exchanges depends on the security of systems controlled by those exchanges. Customers generally do not control the private keys securing their exchange balances.
Even when private keys are not directly compromised, weaknesses in internal authorization systems can expose substantial amounts of cryptocurrency.
The attack also demonstrates the role centralized stablecoin issuers can play during major security incidents. Their ability to freeze assets can help prevent criminals from moving stolen funds. The same technical capability means those assets remain subject to administrative intervention. Both consequences matter to the broader debate over financial privacy and control.
WHAT HAPPENS NEXT?
Investigators must determine the complete attack path, establish whether additional systems were compromised and identify the individuals responsible. Binance must also demonstrate that its reserves and security infrastructure remain sufficient to protect customers.
The exchange has promised a detailed technical post-mortem once its investigation is complete. The final accounting, attribution and recovery figures remain subject to change.