Binance, the world's largest cryptocurrency exchange, says a security breach disclosed on Thursday 29 October affected about $6.3 billion in client digital assets. That makes it the largest crypto theft on record. Every account agrees on the $6.3 billion figure, including Check Point Research's weekly threat report, the company's own statements and coverage by AP, CNBC, the BBC and The New York Times. According to the BBC and Dark Reading, the FBI has attributed the attack to TraderTraitor, the North Korean group also tracked as part of Lazarus. Binance says it will cover all customer losses.
What Happened
AP reported that on 29 October Binance said it was investigating "a potential security issue". Its founder said the incident "does look like a hack on Binance". Later that day the company put the impact at about $6.3 billion. Co-CEO Richard Teng said the company was working with the authorities. Binance suspended all transactions after the breach.
Binance.com, the global exchange, was the platform hit. Binance.US, which serves US residents, said it was not affected. The FBI said on 30 October that it was "aware of the incident" and coordinating with public and private partners.
The exchange reopened on Sunday 1 November. Binance said that between 06:00 and 15:30 GMT it processed $4.649 billion in withdrawals and $1.01 billion in deposits, a net outflow of about $3.64 billion. It put that at just over 2% of the $171 billion in assets it manages. Withdrawals of more than two dozen major tokens, including Bitcoin and Ethereum, have resumed. Other services will return in phases as security checks finish. CNBC reported that Bitcoin fell more than 4% on 30 October as the hack weighed on crypto markets.
What Was Taken
Binance describes about $6.3 billion in client assets as "impacted". Check Point's report describes the same amount as stolen. How much is permanently lost is still unclear:
- Frozen: CNBC reports that about $3 billion of the affected assets has been frozen on blockchain networks, and that Binance has begun recovering some funds. CNBC's headline URL references Circle and Tether freezing funds.
- Covered: The BBC reports Binance saying it has covered about 95% of the stolen assets, and that the rest may take longer to source.
- Reserved: Binance says it has set aside more than $6.3 billion of its own funds. That is on top of its SAFU emergency fund, which CNBC puts at about $1 billion.
- Still moving: Alec Zebrick of Chainalysis told the BBC that the attackers are "layering these funds across many thousands of addresses", and that laundering remains active.
No customer personal data has been reported as exposed. The theft was of digital assets from the exchange's own wallets.
The Attack Technique
Binance's account of how the attack worked has changed over time:
- Initial access: Teng first said the breach "may have started with a compromised DevOps engineer's laptop". That access reached a service container which had permission to submit withdrawal transactions. Check Point's report repeats this account.
- Wider compromise: Teng later said it was "not a simple 'one-click' action" but a "more complex attack process". Binance has since said its investigation found "additional points of breach" beyond the one device.
- Approval bypass: Dark Reading reports that the attackers abused an Ethereum account-delegation mechanism to gain authority to approve transactions on a hot wallet, getting around normal approval controls. Dark Reading says billions were drained in about 20 minutes.
- No key theft: Binance says it has found no evidence that the private keys controlling the wallets were leaked.
Raghu Nandakumara of Illumio told the BBC that the engineer may have been "talked into taking a test" that delivered malware. That is a known TraderTraitor tactic of fake job offers and fake coding tests, but Binance has not confirmed it.
On attribution, CNBC's early coverage said the culprit was not yet clear. TRM Labs pointed to North Korea because the attack looked like the Bybit and KelpDAO heists: small Tornado Cash withdrawals to fund an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. The BBC and Dark Reading now report that the FBI has formally attributed the attack to TraderTraitor.
Why It Matters
This theft is larger than the roughly $1.5 billion stolen from Bybit in 2025, which was also attributed to North Korea. It confirms that a small set of state-backed operators keeps finding a reliable route into crypto platforms: social engineering of individual engineers, followed by abuse of legitimate withdrawal paths. Tim Rawlins of NCC Group told Dark Reading that the core failure is structural: "no single compromise, such as a hacked employee laptop" should be able to authorize a transfer. The lesson applies to any organization where one internal system can move money. That includes payment processors, treasury teams and fintechs, not only crypto exchanges.
The New York Times also notes that no US regulator appears able to compel Binance to repay customers. Repayment depends on the company's own pledge.
What Organizations Should Do
- Make approvals independent. Withdrawal and payment approvals should need sign-off from separate systems, people and devices, so one compromised endpoint cannot both start and approve a transfer.
- Lock down engineer endpoints. Treat DevOps and developer laptops as privileged assets. Use separate admin workstations, application allow-listing, and EDR that watches for malware delivered through package installs or coding tests.
- Train staff on fake recruiting. Brief engineers on TraderTraitor's fake job offers and "technical test" lures, and give them a simple way to report them.
- Audit delegation and signing paths. Review smart-contract wallet delegation, pre-signed transactions and service-container permissions. Test attack paths from a single breached device to the ability to move funds.
- Add speed limits. Use velocity caps, time delays and anomaly alerts on large or batched withdrawals, so an attack that takes 20 minutes can be stopped partway.
- Prepare for recovery. Agree freeze procedures in advance with stablecoin issuers and blockchain analytics firms so stolen funds can be frozen within hours.
Sources: 2nd November – Threat Intelligence Report | Binance users withdraw $3.6bn after largest-ever crypto hack | Binance hack - who is behind it, is my money safe and what we know... | Binance crypto hack: What happens to customer funds on exchanges | Binance hack: $6.3 billion impacted in record crypto theft | Binance Hack: One Compromised Laptop Can Cost Billions in Crypto | What Protections Exist for Binance's Customers? | Binance flags 'potential security issue,' says approximately $6.3 b...