On October 29, 2026, Binance, the world's largest cryptocurrency exchange, suffered a security breach involving approximately $6.3 billion in digital assets across ten blockchains, prompting the suspension of deposits and withdrawals as a precaution. The attack, which blockchain intelligence firm TRM Labs attributes to North Korea's TraderTraitor hacking group, involved unauthorised transactions that transferred funds from Binance-controlled wallets.
The incident could become the largest cryptocurrency theft on record, significantly exceeding the $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025. According to TRM Labs, approximately $6.36 billion was transferred from Binance wallets, with most of the transactions taking place within approximately 20 minutes.
Binance's preliminary investigation indicates that the breach may have originated from a compromised laptop belonging to a DevOps engineer. The attacker allegedly used access obtained through the device to enter a service container and submit unauthorised withdrawal transactions. However, the exchange said it had found no evidence that any wallet private keys had been compromised.
Following the incident, Binance temporarily suspended deposits and withdrawals while its security teams investigated the breach and secured the affected wallet infrastructure. The exchange also revoked authorisation for the affected addresses and engaged law enforcement agencies and blockchain intelligence partners to trace and recover the assets.
Efforts to contain the damage have resulted in billions of dollars being frozen across several blockchain networks. Binance initially reported that approximately $2.54 billion had been frozen before updating the figure to approximately $3 billion. TRM Labs separately estimated that around $2.7 billion had been frozen on-chain by October 30, reflecting additional asset freezes identified through its tracking activities.
Blockchain intelligence firms TRM Labs and Chainalysis have linked the attack to North Korea. TRM Labs attributed the breach to TraderTraitor, a hacking unit associated with the North Korean state, citing similarities in transaction patterns and methods used in previous cryptocurrency thefts. The group has also been linked to earlier attacks targeting digital asset platforms, including the Bybit breach.
Binance has pledged to cover all losses resulting from the incident through its Secure Asset Fund for Users (SAFU) and corporate funds. The exchange has maintained that customer funds remain safe and said it would publish an updated Proof of Reserves once the security remediation process is complete.
The incident has renewed concerns about cybersecurity risks facing cryptocurrency exchanges, particularly the security of wallet infrastructure and internal access controls. Investigators are expected to continue tracing the remaining assets, while Binance is yet to publish a comprehensive technical post-mortem detailing the breach and the measures being implemented to prevent similar attacks.
