Binance hit by potentially biggest crypto hack in history: $6.3 billion affected, who is behind it? - News9live
Binance is investigating a cyberattack involving approximately $6.3 billion in cryptocurrency, potentially making it the largest crypto hack ever recorded. The exchange has confirmed that around $3 billion in affected assets have been frozen.
The incident came to light on October 29, with billions of dollars moving out of wallets linked to the exchange. Binance has confirmed the security incident and says around $3 billion in affected assets have already been frozen.
The company has promised to cover losses, but investigators are still trying to establish exactly what happened and how much money attackers managed to take away. Reuters and TechCrunch reported on the incident as cryptocurrency markets reacted to the news.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.
We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified. The estimated total impact sits at around $6.3B.
We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.
Binance will cover all hacking losses.
As an immediate precaution, Binance has temporarily suspended deposits and withdrawals while security checks are completed. It has also revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners to trace and recover funds.
These figures are huge and unprecedented, but they represent the estimated impact of the attack, rather than a confirmed final loss. Investigators are tracing the full attack path through the compromised computer, which may be the entry point of the incident.
Suspected North Korean-linked group
The attackers’ identities remain unconfirmed. According to The Washington Post, cybersecurity firms TRM Labs and Pangolin Intelligence have linked the incident to TraderTraitor, a North Korean-backed hacking group.
The group has previously been associated with major cryptocurrency thefts, including the 2025 Bybit attack. Binance has not publicly confirmed that attribution, but the scale of the alleged theft makes it a significant development in the ongoing battle against state-sponsored cybercrime.
Historical context of exchange hacks
Cryptocurrency exchanges have faced several major cyberattacks over the years, with hackers stealing billions of dollars in digital assets. One of the biggest incidents took place in February 2025, when hackers stole approximately $1.5 billion from Bybit.
Investigators linked that attack to North Korea’s Lazarus Group. The hackers reportedly manipulated a transaction approval process to gain control of cryptocurrency stored in a wallet. India has faced similar incidents, such as the July 2024 breach of WazirX, which lost around $235 million.
Other major incidents include Japan’s Coincheck hack in 2018 and the collapse of Mt. Gox following years of cryptocurrency theft. Binance itself suffered a security breach in May 2019, when hackers stole around 7,000 Bitcoin worth approximately $40 million at the time.
The exchange covered the losses using its emergency funds. If the latest alleged $6.3 billion Binance incident is independently confirmed, it would exceed the scale of these earlier attacks by a considerable margin.
Next steps and recovery efforts
Investigators will now focus on tracing the remaining cryptocurrency, identifying the attackers and checking whether the stolen assets can be recovered. Binance has promised a detailed technical report and updated proof of reserves once its investigation and security repairs are complete.
Withdrawals remain paused while the team completes a security revamp of the withdrawal service and its related addresses. The exchange expects to resume within 48 hours and will continue to share updates through official channels.
The company is working closely with its law enforcement partners to confirm the identity of the criminals and bring them to justice. Users are advised to rely only on official Binance channels for updates and to contact customer support if they have any questions.
Related
