The world’s largest cryptocurrency exchange, Binance, is investigating a massive security breach after hackers allegedly moved cryptocurrency worth an estimated $6.3 billion. The incident has triggered an international investigation, prompted several major crypto companies to freeze suspicious assets and raised fresh concerns about the security of digital currencies.
The suspected attack, reported on October 29, is being examined by blockchain intelligence firms and law enforcement agencies. Initial assessments by TRM Labs and Chainalysis have linked the incident to North Korea’s TraderTraitor hacking group. However, the investigation is continuing, and the identity of the attackers has not been officially established.
According to blockchain analysis, approximately $6.36 billion in cryptocurrency was transferred across 10 blockchains. A significant portion of the transactions reportedly took place within around 20 minutes. If confirmed, the incident would rank among the largest cryptocurrency thefts in history, surpassing the $1.5 billion attack on crypto exchange Bybit in February 2025.
Binance has acknowledged the security incident and said it is working with law enforcement agencies, blockchain investigators and other cryptocurrency companies to trace the stolen assets. The exchange is also examining how the attackers gained access to its systems and whether weaknesses in internal security arrangements were exploited.
The amount of cryptocurrency frozen following the incident has become a major focus. Binance initially reported that it and its partners had frozen around $2.54 billion worth of assets linked to the suspected hack. Subsequent updates indicated that approximately $3 billion in affected funds had been located. However, locating or freezing cryptocurrency does not necessarily mean that the entire amount has been recovered.
Several companies acted quickly to restrict the movement of suspicious funds. Tether, the issuer of the USDT stablecoin, froze nearly $1.57 billion linked to the incident. Circle, which issues USDC, froze more than $800 million. Ripple also froze approximately $200 million, while World Liberty Financial worked with cryptocurrency custodian BitGo to restrict additional assets.
Stablecoins are digital currencies designed to maintain a relatively stable value and are widely used for cryptocurrency trading and transfers. Their issuers can freeze tokens associated with suspicious activity, making it difficult for hackers to move or use the funds. The coordinated action by these companies has therefore become an important part of efforts to contain the suspected breach.
Binance has assured customers that their funds remain safe and said it would cover losses arising from the incident. The exchange has also pledged to work with its partners to recover the affected assets. The assurance is aimed at preventing panic among users and maintaining confidence in the platform during the investigation.
The exchange temporarily suspended withdrawals while carrying out security checks and responding to the incident. Deposits were reported to be unaffected. Binance indicated that withdrawal services were expected to resume within approximately 45 hours, subject to the completion of security checks and other necessary measures.
The company’s preliminary investigation suggested that a compromised laptop belonging to one of its engineers may have provided an entry point for the attackers. The device could potentially have enabled unauthorised access to internal systems. Binance later indicated that investigators had identified additional points of breach, suggesting that the attack may have involved more than one security weakness.
The precise method used by the hackers has not yet been fully established. Binance has said it found no evidence that private keys associated with its wallets had been leaked. Private keys are critical security credentials that authorise cryptocurrency transactions. The exchange has promised to provide more technical details as its investigation progresses.
The suspected involvement of North Korean hackers has added an international dimension to the incident. TRM Labs attributed the attack to the TraderTraitor group with a high degree of confidence, while Chainalysis also pointed to the group’s possible involvement. North Korean-linked cybercriminal networks have previously been accused of targeting cryptocurrency exchanges and other digital asset platforms to obtain funds.
The incident also affected cryptocurrency prices. Bitcoin reportedly dropped to around $76,368, its lowest level in six weeks, while Ethereum fell more than 3% to approximately $2,178. Binance’s BNB token also came under pressure, declining around 5% over a 24-hour period. Shares of cryptocurrency exchange Coinbase and bitcoin investment firm Strategy also fell in extended trading.
The scale of the suspected theft has renewed questions about the security of centralised cryptocurrency exchanges. These platforms hold digital assets on behalf of customers, making them attractive targets for cybercriminals. Binance has more than 300 million registered users globally and held approximately $162.8 billion in assets under custody, according to its 2025 annual report.
The exchange also operates the Secure Asset Fund for Users, commonly known as SAFU. The fund is designed to provide an additional layer of protection for customers in the event of security incidents and has been valued at around $1 billion. The latest breach has brought renewed attention to the way cryptocurrency platforms manage reserves, protect wallet access and respond to cyberattacks.
Cryptocurrency theft remains a major challenge for the digital asset industry. TRM Labs estimated that hackers stole around $2.9 billion worth of cryptocurrency across nearly 150 attacks in 2025. The Binance incident could further affect investor confidence, particularly among customers who depend on exchanges to safeguard their holdings.
The final financial impact will depend on how much of the affected funds can be recovered and what investigators establish about the security breach. Binance’s commitment to cover losses may reassure customers, but the incident has once again highlighted the risks facing the global cryptocurrency industry.
