- Binance confirmed a $6.3 billion security breach, with approx $2.7 billion in stolen assets frozen.
- The attacker still holds over $2.4 billion in ETH and BTC after moving funds to avoid freezing efforts.
- TRM Labs linked the attack to North Korea’s TraderTraitor group and identified a possible compromise of Binance’s hot wallet signing infrastructure.
Binance has confirmed a major security breach involving approximately $6.3 billion in cryptocurrency, with nearly $3 billion in affected assets frozen following collaborative efforts by the exchange and multiple crypto firms to stop the movement of stolen funds.
The breach occurred on October 29, when digital assets worth billions were transferred without authorization from Binance wallets across 10 distinct blockchain networks. This event stands as the largest recorded cryptocurrency theft in history, exceeding the $1.5 billion Bybit hack that took place in February 2025.
According to Binance’s preliminary findings, the security incident may stem from a compromised laptop belonging to a DevOps engineer. The hacker allegedly leveraged access gained through this device to enter a service container and submit unauthorized withdrawal transactions.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
– temporarily suspended deposits and withdrawals while security checks are completed;
– revoked the affected address authorisation;
– engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
https://t.co/ywB2mKFy0p— Binance (@binance) October 30, 2026
In response to the discovery, Binance temporarily halted deposits and withdrawals while conducting security assessments. The platform additionally revoked authorization for the impacted addresses and reached out to law enforcement agencies and blockchain intelligence firms to track down the stolen funds.
Binance stated that it found no signs of leaked wallet private keys. The exchange reassured users that their funds remain secure, confirming that the Secure Asset Fund for Users (SAFU) and corporate reserves will fully cover all losses.
North Korean Hackers Linked to the Attack as $3B in Assets Frozen
Blockchain intelligence provider TRM Labs attributed the operation to TraderTraitor, a North Korean hacking unit. The FBI previously tied this same hacking group to the February 2025 Bybit hack.
Data from TRM Labs indicates that approximately $6.36 billion in digital assets went to attacker-controlled wallets, with the vast majority moved within a 20-minute window.
Investigators also uncovered how the hacker may have seized control of Binance’s wallet infrastructure. On the Ethereum network, the perpetrator reportedly employed EIP-7702 authorization to force a Binance hot wallet to execute a malicious smart contract. By preparing 50 pre-signed authorizations beforehand, the attacker was able to match the wallet’s transaction sequence and execute the transfer.
The stolen funds were dispersed across multiple networks, including Ethereum, Bitcoin, Tron, XRP Ledger, and Solana. Ethereum accounted for roughly $3.79 billion of the transfers, followed by Bitcoin at $1.47 billion and Tron at approximately $628 million.
TRM Labs reported that roughly $2.7 billion in assets had been frozen on-chain by October 30, while Binance’s separate figures put the total amount frozen at approximately $3 billion.
Crypto Companies Freeze Billions as Investigation Reveals How Attack Happened
Following the breach, several major cryptocurrency firms intervened to block the hacker from moving the stolen funds. Tether, Circle, Ripple, and World Liberty Financial froze $2.67 billion in associated stablecoins. Furthermore, Arbitrum’s Security Council stepped in to freeze 8,426 ETH alongside 74.6 million ARB.
Despite these measures, the attacker moved swiftly to evade freezing actions. According to TRM Labs, the perpetrator sold USDT to market makers and borrowed ETH against USDT through the Aave lending protocol, allowing them to shift portions of the stolen capital into assets immune to direct stablecoin issuer freezes.
The hacker still retains over 420,000 ETH and 18,270 BTC, valued at roughly $2.4 billion. Because these decentralized assets cannot be frozen directly by issuers like stablecoins can, recovering them presents a greater challenge.
The cross-chain transfers also featured valid signatures, indicating a possible breach of Binance’s transaction-signing apparatus.
Binance has not formally confirmed the identities of the culprits, noting that its investigation remains ongoing and that a detailed technical report will be released once all facts are verified.
The security event also impacted broader market sentiment. Bitcoin pulled back to $76,000, while Ether dropped more than 3% as news of the exploit stoked industry-wide concerns regarding exchange security.
Frequently Asked Questions
How much was stolen in the Binance security breach?
The breach involved approximately $6.3 billion in cryptocurrency.
Who has been linked to the Binance hack?
TRM Labs linked the attack to TraderTraitor, a North Korean hacking unit.
Are user funds safe after the incident?
Binance has assured users that their funds are safe and that all losses will be covered by the SAFU fund and company assets.
How much of the stolen money has been frozen?
Crypto companies and blockchain partners have frozen roughly $2.7 billion to $3 billion in affected assets.
