Key Takeaways
- • Binance suffered the largest asset theft in its history overnight on October 29-30, with hackers stealing a total of $6.3 billion, according to CNBC.
- • Binance and its blockchain partners froze nearly half of the stolen funds, roughly $3 billion, across multiple blockchains.
- • Binance attributed the breach to a compromised laptop belonging to a DevOps engineer and said user deposits were not affected and that users' private wallet keys were not found to be leaked.
- • TRM Labs attributed the hack to TraderTraitor, a North Korean hacking group, which the FBI previously linked to the February 2025 Bybit hack of $1.5 billion.
- • Binance pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and its own funds, and expects to resume withdrawals within 48 hours.
Summary
Cryptocurrency exchange Binance was hit by the largest asset theft in its history overnight on October 29-30, according to CNBC. Unidentified hackers breached the company's systems and triggered mass withdrawals from users' crypto wallets, stealing a total of $6.3 billion. Binance said it had found no evidence that users' private wallet keys had been leaked. The company and its blockchain partners managed to freeze nearly half of the stolen funds, or around $3 billion.
Binance said it would cover all losses using its Secure Asset Fund for Users (SAFU) and its own funds, and stressed that users' assets remain safe. The exchange temporarily suspended deposits and withdrawals during security checks, contacted blockchain analytics firms and law enforcement agencies, and later said user deposits had not been affected and the platform continued to operate normally. Binance expects to resume withdrawals within 48 hours after upgrading relevant security systems. Citing a preliminary investigation, the company linked the breach to a "compromised laptop belonging to a DevOps engineer," which hackers used to access its systems. It is tracing the full attack path and plans to publish a detailed report on the root cause, which it said resulted from "multiple factors."
According to blockchain analytics firm TRM Labs, most funds were withdrawn between 20:05 and 20:25 London time (01:05-01:25 in Tashkent) through wallets across 10 blockchains. The attack was made possible by a compromise of the infrastructure Binance uses to sign hot wallet transactions, and experts said preparations had begun at least 36 hours earlier. TRM Labs attributed the hack to TraderTraitor, a North Korean group that the US FBI previously held responsible for the February 2025 hack of Bybit, in which $1.5 billion was stolen.
Market reaction was negative. According to CoinMarketCap, Bitcoin fell 2.3% over 24 hours to $78,430 after dropping as low as $76,400, its lowest level since September. Ethereum briefly fell below $2,200 for the first time since August before recovering to about $2,244, down 3.4%. Binance's native token BNB dropped 5% to $717.
Ari Redbord, head of global policy at TRM Labs and a former US federal prosecutor, said recovering frozen assets requires several legal procedures, typically including a court order or other legal authorisation. According to Redbord, stablecoins such as USDC and USDT are generally easier to recover because their issuers can freeze them, whereas recovering Bitcoin or Ethereum requires tracing funds through exchanges and other services.
Binance said it would cover all losses using its Secure Asset Fund for Users (SAFU) and its own funds, and stressed that users' assets remain safe. The exchange temporarily suspended deposits and withdrawals during security checks, contacted blockchain analytics firms and law enforcement agencies, and later said user deposits had not been affected and the platform continued to operate normally. Binance expects to resume withdrawals within 48 hours after upgrading relevant security systems. Citing a preliminary investigation, the company linked the breach to a "compromised laptop belonging to a DevOps engineer," which hackers used to access its systems. It is tracing the full attack path and plans to publish a detailed report on the root cause, which it said resulted from "multiple factors."
According to blockchain analytics firm TRM Labs, most funds were withdrawn between 20:05 and 20:25 London time (01:05-01:25 in Tashkent) through wallets across 10 blockchains. The attack was made possible by a compromise of the infrastructure Binance uses to sign hot wallet transactions, and experts said preparations had begun at least 36 hours earlier. TRM Labs attributed the hack to TraderTraitor, a North Korean group that the US FBI previously held responsible for the February 2025 hack of Bybit, in which $1.5 billion was stolen.
Market reaction was negative. According to CoinMarketCap, Bitcoin fell 2.3% over 24 hours to $78,430 after dropping as low as $76,400, its lowest level since September. Ethereum briefly fell below $2,200 for the first time since August before recovering to about $2,244, down 3.4%. Binance's native token BNB dropped 5% to $717.
Ari Redbord, head of global policy at TRM Labs and a former US federal prosecutor, said recovering frozen assets requires several legal procedures, typically including a court order or other legal authorisation. According to Redbord, stablecoins such as USDC and USDT are generally easier to recover because their issuers can freeze them, whereas recovering Bitcoin or Ethereum requires tracing funds through exchanges and other services.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.