The world’s largest cryptocurrency exchange is dealing with what security experts are calling the biggest crypto theft ever recorded. Binance said on Thursday, October 29, that $6.3 billion in digital assets had been affected by a security breach, and it halted withdrawals while it worked to lock down its systems.
Here is what has been confirmed so far, based on reporting from the BBC, AP and Axios.
What happened
Binance said roughly $6.3 billion (about £4.7 billion) of digital assets were impacted. About half of that has been frozen, according to the company, but a large share remains in the hands of the attackers.
Binance co-CEO Richard Teng said the company’s initial investigation suggested the attack began with a compromised engineer’s laptop. “That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions,” he said in a statement.
Teng stressed that this was not a simple mistake by one person. “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process,” he said, adding that the investigation had not attributed responsibility to any individual and had found no evidence that any wallet private keys had leaked.
In a later update posted on X, Binance said its investigation had uncovered additional points of breach. The company said it was still gathering facts and promised a detailed post-mortem once the investigation is complete.
Who is being blamed
Two blockchain analytics firms, Chainalysis and TRM Labs, have linked the theft to a North Korean hacking unit known as TraderTraitor. Chainalysis said it had “high confidence” in the link. Cybersecurity firm Check Point said the unit is also known in the industry as the Lazarus Group, which was blamed for the record $1.5 billion hack of the Bybit exchange in 2025.
TRM Labs said several elements of the Binance attack resemble earlier North Korean-linked incidents. Its global head of policy, Ari Redbord, told the BBC the hack is a “watershed moment” unlike anything the industry has seen, and warned that efforts to trace and recover the funds are far from over.
Western security agencies have previously said North Korea uses stolen crypto to help fund its weapons programmes. The regime has denied involvement in hacks in the past. Binance did not directly address the North Korea link, saying it is working with law enforcement partners to identify those responsible.
What has been frozen so far
The response from the wider crypto industry has been fast:
- Binance says about half of the affected assets have been frozen.
- Stablecoin issuers Tether and Circle said they froze a combined total of about $2.4 billion in assets linked to the incident.
- World Liberty Financial, a crypto company linked to President Donald Trump’s family, said it worked with partners to freeze stolen funds.
Binance co-CEO Yi He thanked token issuers for freezing assets and said withdrawals would stay disabled “until the environment is confirmed to be secure.”
What it means for users
Binance has said it will “cover all losses.” The company has more than 300 million registered users worldwide, according to the BBC, and said in 2024 that it held more than $160 billion in assets in custody.
The incident concerns Binance.com. The separate, much smaller Binance.US platform, which serves American residents, said it was not affected. Coinbase also said it was unaffected and was monitoring the situation.
Markets reacted quickly. Bitcoin fell more than 4% after early alerts about a possible hack circulated online, and other major tokens including Ethereum and Solana also dropped sharply. Axios reported that Binance halted trading on Thursday as the scale of the breach became clear.
If you hold assets on any exchange, the practical steps are the same as after any major security incident: watch for official updates only from the exchange’s verified channels, be wary of messages or links claiming to offer refunds or “recovery” help, which are a common follow-up scam, and make sure two-factor authentication is switched on for your accounts.
A pattern of bigger, smarter attacks
Security experts say the method matters as much as the size. Check Point’s chief information security officer, Jayant Dave, said the attack resembled a September breach at the Bitget exchange in which $388 million was lost. “This implies that attackers no longer need the vault keys,” he said. “They target the systems and people with authority to use them.”
Axios noted the attack caps a run of high-profile intrusions and data breaches that has been dubbed “Black October,” fuelling wider fears about the security of critical online systems.
What to watch next
The key questions now are how many more breach points investigators find, how much of the stolen money can still be frozen or traced, and when Binance will safely restore withdrawals. Expect the frozen totals and the official loss figure to keep changing as exchanges, stablecoin issuers and investigators work through the trail.
For now, the theft stands as a stark reminder that even the biggest platforms in crypto remain prime targets.
Image: Binary damage code (28227210988) by Markus Spiske from Forchheim, Bavaria Upper Franconia via Wikimedia Commons, CC0 1.0
