Binance Hack Hits $6.3 Billion; Blockchain Firms Link Record Crypto Theft to North Korea

Binance, the world's largest cryptocurrency exchange, said a security incident on Thursday, Oct. 29, had an estimated total impact of around $6.3 billion, and blockchain intelligence firms have attributed the attack to TraderTraitor, a hacking group they link to North Korea. The exchange said it had worked with blockchain partners to freeze roughly $3 billion of the affected assets and that it would cover all losses, NPR reported.

Blockchain analytics firm TRM Labs said the theft was the largest cryptocurrency heist on record. "An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM said, according to CBS News and The Associated Press. The previous record was the roughly $1.5 billion theft from the Bybit exchange in February 2025, which the FBI attributed to North Korea and TraderTraitor.

How the funds left the exchange

Blockchain analysis company Chainalysis said funds began leaving Binance hot wallets across multiple blockchains at around 4:20 p.m. Eastern Time on Oct. 29, and that unauthorized transfers totaled approximately $6.4 billion. Analytics firm Arkham put the total at $6.01 billion, taken from hot wallets on nine blockchains between 4:10 p.m. and 7:05 p.m. ET, Decrypt reported. Hot wallets are wallets connected to the internet.

In a statement on X late Thursday, Binance said: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." The company added: "We have found no evidence of any wallet private key leak," according to NPR.

On Friday, the exchange said its investigation had uncovered "additional points of breach." Co-chief executive Richard Teng wrote that the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action," describing "a more complex attack process," Decrypt reported. "Our investigation has not attributed responsibility to any individual," Teng wrote.

North Korea attribution

TRM attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," the firm said, according to CBS News. TRM said preparations for the attack began at least 36 hours before the theft, with the attackers using the cryptocurrency mixing service Tornado Cash to fund their wallets, CNBC reported.

Chainalysis said its strongest evidence came when its investigators observed funds stolen from Binance mixing in real time with funds stolen in last month's exploit of the Bitget exchange, which had been attributed to North Korean actors. Analytics firm Elliptic also attributed the theft to North Korea, putting the total at $6.43 billion drained across 11 blockchains and calling it "almost certainly the largest theft of any kind in history."

Elliptic cautioned that "No government or law enforcement agency has confirmed attribution, and Binance has not commented on who was responsible." It noted that only around $39,000 of the Binance funds had reached the address shared with the Bitget proceeds, and that a shared laundering network does not necessarily mean the same hacker carried out both thefts. North Korea has always denied involvement in such attacks, the BBC reported.

Frozen funds and withdrawals

Stablecoin issuers moved quickly as funds left the exchange. Tether chief executive Paolo Ardoino said the company froze the equivalent of more than $1.5 billion related to "a potential Binance exchange hack," and Circle co-founder and chief executive Jeremy Allaire said Circle froze more than $800 million "in coordination with law enforcement," according to NPR. Ripple helped halt the movement of $200 million linked to the attack, Binance co-founder Yi He said, CNBC reported.

Ari Redbord, global head of policy at TRM Labs, told CNBC that a freeze and a recovery are separate steps. "A freeze stops the money from moving, and recovery follows through legal process," he said. Bitcoin and ether, which have no issuer able to freeze them, are harder to recover, he said. As of Friday morning, Arkham's page for the attacker showed holdings of about 18,270 bitcoin and 488,364 ether, alongside frozen stablecoin balances, according to Decrypt.

Binance said it would cover losses from its SAFU emergency fund and from company funds. By Friday morning deposits were operating normally, while withdrawals remained suspended during a security overhaul; the exchange said it remained on track to resume withdrawals in 45 hours, Decrypt reported. Binance.US, a separate exchange for U.S. residents, said it was not affected, according to the BBC.

"Bottom line – your money is safe, and we're covering every loss," Teng said, The Guardian reported. Binance founder Changpeng Zhao, who pleaded guilty in 2023 to a felony related to failing to prevent money laundering on the platform and was pardoned by President Donald Trump in 2025, posted that "User funds are safe!" but said the incident "does look like a hack on Binance."

Market reaction

Bitcoin dropped more than 3% in early Asian trading on Friday to a six-week low of $76,368, The Guardian reported. Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, told CNBC: "The most important takeaway for markets is that this does not currently appear to create meaningful solvency risk for Binance." Farrell said the key indicators to watch were how quickly withdrawals resume and whether outflows remain orderly.

In the United Kingdom, the Financial Conduct Authority said that Binance was not registered with it to provide crypto services there, but that it was "aware of the reported incident and engaging with them to understand the impact," according to The Guardian.