Binance, the world's largest cryptocurrency exchange, has suffered a massive security breach estimated at approximately $6.3 billion, making it one of the largest cryptocurrency thefts ever reported.
The incident occurred on 29 October 2026, with attackers moving assets from Binance-controlled wallets across multiple blockchain networks. Blockchain security firms have linked the attack to North Korean hacking groups, although investigations are ongoing.
How the Attack Happened
Binance's initial investigation suggests that the incident may have started with a compromised laptop belonging to a DevOps engineer. The attacker allegedly used access to the device to enter a service container and submit unauthorized withdrawal transactions.
Binance said it had found no evidence that wallet private keys were leaked. However, the exchange later acknowledged that investigators had identified additional potential points of breach.
According to blockchain intelligence firm TRM Labs, the attackers moved approximately $6.36 billion across ten blockchain networks. Much of the theft reportedly happened within about 20 minutes.
North Korean Hackers Suspected
Blockchain intelligence companies, including TRM Labs and Elliptic, have attributed the operation with high confidence to North Korea-linked hacking group TraderTraitor.
The group has previously been associated with major cryptocurrency thefts, including the $1.5 billion Bybit breach in February 2025.
Investigators are examining the movement of stolen funds and similarities between the Binance incident and previous attacks. The attribution remains an assessment by security researchers rather than a confirmed identification by Binance.
Billions in Assets Frozen
Following the attack, Binance worked with cryptocurrency issuers, blockchain networks, law enforcement agencies and security firms to trace and freeze affected assets.
By 30 October, approximately $3 billion in assets had reportedly been frozen on-chain. This included stablecoins and other digital assets that could be restricted by their issuers or network authorities.
However, recovering the remaining funds presents a significant challenge, particularly where assets have been converted into cryptocurrencies that cannot be frozen by a central issuer.
Binance Promises to Cover Customer Losses
Binance has stated that customer funds are safe and that it will cover all affected losses using its Secure Asset Fund for Users (SAFU) and company resources.
The exchange also temporarily suspended withdrawals on affected networks while conducting security checks. Deposits remained operational, according to its security update.
Binance has pledged to work with law enforcement and blockchain intelligence partners to recover the stolen assets and publish an updated Proof of Reserves following remediation.
A Warning for Cryptocurrency Security
The Binance incident highlights the risks associated with centralized cryptocurrency exchanges and the internal infrastructure used to manage digital assets.
It also demonstrates that protecting wallet private keys alone is not enough. Employee devices, privileged accounts, internal services, transaction approval systems and operational access controls must all be secured.
For cryptocurrency platforms, strong endpoint protection, multi-layer transaction verification, restricted administrative access, continuous monitoring and incident response planning remain essential.
The investigation is ongoing, and the full technical details of the breach are yet to be published by Binance.
Sources:
- Binance Security Update: binance.com/…/security-incident-update-2026-10-30-c5a…
