Binance is investigating a suspected $6.3 billion security incident after freezing roughly $3 billion in affected assets with industry partners. The potential Binance cryptocurrency breach, disclosed on October 29, has prompted service suspensions and a pledge to cover customer losses, while blockchain investigator TRM Labs suspects a North Korea-linked hacking group.
Key takeaways
- Binance estimates $6.3 billion was affected, with about $3 billion frozen.
- An engineer’s laptop is the suspected entry point; investigators found no evidence of exposed wallet keys.
- TRM Labs suspects TraderTraitor, the group linked to the February 2025 Bybit theft.
- Binance pledged to cover losses through its user protection fund and company resources.
How the suspected Binance cryptocurrency breach unfolded
Binance’s initial investigation points to a potentially compromised DevOps engineer’s laptop. The exchange said an attacker may have used that device to enter a service container and submit unauthorized withdrawal transactions.
Investigators found no evidence of a wallet private-key leak, Binance said. Its security teams were examining the incident and would release verified findings through official channels.
Binance has 335 million registered users worldwide and held about $162.8 billion in assets under custody, according to its 2025 annual report.
The exchange described the event as a security incident under investigation. Former CEO and major shareholder Changpeng Zhao offered a more direct assessment: “It does look like a hack on Binance,” he said.
Service restrictions and a multibillion-dollar asset freeze
Binance temporarily halted deposits, withdrawals and some trading products while securing its systems and tracing affected assets. It said approximately $3 billion had been frozen on-chain, with control partially recovered through work with partners.
The deposit and withdrawal suspension began at approximately 00:30 GMT on October 30. Binance also suspended Alpha trading, revoked the affected address authorization and enlisted law enforcement agencies and blockchain intelligence firms.
In a subsequent update, co-founder Yi He said deposits were operating normally and the exchange was improving withdrawal services and related address controls. Binance expected to begin restoring withdrawals within 48 hours.
Stablecoin issuers helped restrict the movement of affected funds. Tether CEO Paolo Ardoino said his company froze approximately $1.6 billion in USDT connected to the suspected attack. Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC.
Yi He said Ripple helped stop the movement of $200 million linked to the incident. World Liberty Financial also worked with custodian BitGo to freeze funds; Yi put those amounts at $27 million in stablecoins and about $2 million in World Liberty tokens.
Separately, blockchain data provider Arkham Intelligence linked nearly $6 billion in digital assets to 55 wallet addresses associated with the potential exploit. Those holdings included bitcoin, ether, solana and stablecoins.
TRM Labs points to a North Korean-linked group
TRM Labs suspects TraderTraitor was responsible, citing strong intelligence drawn from on-chain and off-chain sources. The investigation firm said it had a high degree of confidence in that assessment and identified similarities with earlier North Korea-linked operations.
TraderTraitor, believed to be part of the Lazarus Group, was also linked to the theft of $1.5 billion from Bybit in February 2025. If confirmed at Binance’s estimated scale, this incident would exceed that previous cryptocurrency theft record by more than four times.
The attribution remains TRM Labs’ assessment. Analytics firm Chainalysis also said the incident, if confirmed, could rank as the largest cryptocurrency heist.
Markets fall as Binance promises customer coverage
Reports of the suspected Binance cryptocurrency breach sent major digital assets lower, while Binance pledged to absorb customer losses. The exchange said it would use its Secure Asset Fund for Users and company funds to cover them.
Bitcoin fell 3.2% on October 29 and dropped more than 4% on October 30. Ethereum recovered from an almost 6% decline to trade 0.8% lower at around 04:00 GMT, while BNB was 2.7% higher after an earlier fall of nearly 10%. Circle shares fell about 5% in after-hours trading on October 29.
“Binance will cover all hacking losses,” Yi He said. Zhao added: “As a shareholder, I expect all user funds will be fully covered.” He stepped down as CEO in 2023 after pleading guilty to failing to prevent money laundering; Donald Trump pardoned him in 2025.
Binance said it would publish a detailed technical report after completing its investigation and an updated Proof of Reserves following remediation.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
Powered by WPeMatico
