Binance pledges to cover losses after a record $6.3 billion hack linked to North Korea. Partners have frozen approximately $3 billion. | Credit: CCN.com
Share
Key Takeaways
Binance suffered a record $6.3 billion crypto breach affecting wallets across 10 blockchains.
TRM Labs and Chainalysis linked the attack to North Korea’s TraderTraitor hacking group.
Investigators suspect a compromised engineer’s laptop enabled unauthorized withdrawals; the full attack path remains unconfirmed.
Binance has pledged to cover customer losses after a $6.3 billion security breach that blockchain investigators describe as the largest cryptocurrency theft on record, triggering a scramble to freeze stolen assets and contain the market fallout.
The world’s largest crypto exchange said approximately $3 billion in affected assets had been frozen onchain. It temporarily suspended deposits and withdrawals while investigators examined how an attacker gained access to its withdrawal infrastructure.
The October 29 attack struck wallets across 10 blockchains. TRM Labs and Chainalysis attributed the operation to North Korea’s TraderTraitor hacking group, which investigators previously linked to the $1.5 billion Bybit theft in February 2025.
Try Our Recommended Crypto Exchanges
Sponsored
Disclosure
We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.
How Hackers Drained Binance Wallets Across 10 Blockchains
Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop. The exchange said the attacker may have used that access to enter a service container and submit unauthorized withdrawal transactions.
Binance said it had found no evidence of leaked wallet private keys. It has revoked the affected address authorization and promised a technical account once investigators establish the facts.
TRM estimated the theft at $6.36 billion, with most transfers occurring within roughly 20 minutes. Its analysis suggests the attacker gained access to infrastructure that authorized transactions across multiple networks.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
On Ethereum, the attacker used EIP-7702, a feature that allows a wallet to delegate operations to smart contract code.
A batch of 50 previously signed authorizations enabled a malicious contract to take control of a Binance hot wallet and repeatedly drain incoming funds.
Other affected wallets transferred assets through ordinary signed transactions. TRM said the coordinated activity across different blockchains pointed toward a broader compromise of Binance’s signing infrastructure, although the exchange has not confirmed the full attack path.
Binance Promises Repayment, but Frozen Funds Face Recovery Hurdles
Binance said it would absorb losses using its Secure Asset Fund for Users, known as SAFU, alongside company funds. It also pledged to publish updated proof of reserves after completing remediation.
Binance will cover all losses.
As a precaution, all deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.
Stablecoin issuers helped restrict the attacker’s access to stolen tokens. Tether, Circle, Ripple and World Liberty Financial froze assets, while Arbitrum’s Security Council intervened on its network.
The reported totals reflect different snapshots. TRM counted approximately $2.7 billion frozen as of 00:30 UTC on October 30, while Binance subsequently reported about $3 billion.
Freezing assets does not immediately return them to Binance. TRM policy chief Ari Redbord said that recovery requires a separate legal process, potentially involving court orders and coordination with token issuers.
The attacker also exchanged some stablecoins for bitcoin and ether, reducing issuers’ ability to block further transfers. Investigators can still trace those assets and seek intervention when they reach cooperating exchanges.
Bitcoin Slides as Markets Watch Binance’s Next Move
Coinbase and Strategy shares also fell in extended US trading, reflecting concern that the incident could weaken investor confidence beyond Binance.
Bitcoin slided under $80,000 following the hack announcement. | Credit: CoinMarketCap
Fundstrat’s Sean Farrell told CNBC the breach did not currently appear to create a significant solvency threat. His assessment depended partly on the eventual recovery of frozen assets and Binance’s ability to absorb the remaining losses.
Withdrawal access now represents a critical test. A smooth reopening could support confidence in Binance’s liquidity, while prolonged restrictions could deepen uncertainty.
Binance.US and Coinbase said their platforms were unaffected. For Binance customers, the immediate focus remains when withdrawals resume, how much investigators recover and whether the exchange delivers its promised reimbursement.
Disclaimer:
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Giuseppe Ciccomascolo began his career as an investigative journalist in Italy, where he contributed to both local and national newspapers, focusing on various financial sectors.
Upon relocating to London, he worked as an analyst for Fitch's CapitalStructure and later as a Senior Reporter for Alliance News. In 2017, Giuseppe transitioned to covering cryptocurrency-related news, producing documentaries and articles on Bitcoin and other emerging digital currencies. He also played a pivotal role in establishing the academy for a cryptocurrency exchange website. Crypto remained his primary area of interest throughout his tenure as a writer for ThirdFloor.
