Binance Hit by $6.3 Billion Hack in Largest Crypto Theft on Record

Binance has suffered a security breach with an estimated impact of about $6.3 billion, in what blockchain investigators and market analysts say is the largest cryptocurrency theft ever recorded, surpassing the $1.5 billion Bybit attack of 2025 by more than four times and immediately raising new questions about the security of assets held on centralised crypto exchanges. The world’s largest cryptocurrency exchange said its initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which may have allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. Binance said it had found no evidence that wallet private keys were leaked, although the company later acknowledged that its investigation had identified additional points of breach, suggesting that the attack was more extensive than initially understood. Binance estimated the total impact at about $6.3 billion and said approximately $3 billion in affected assets had already been frozen through cooperation with blockchain networks, stablecoin issuers and other industry participants. The company temporarily suspended withdrawals while conducting security checks, while deposits remained operational, and said that it would cover losses using its Secure Asset Fund for Users and company resources. In its official statement, Binance said: “User funds are safe.” The scale of the breach places Binance in a difficult position because its user protection reserve, known as SAFU, has historically been valued at around $1 billion, substantially below the estimated value affected by the attack. Binance has therefore committed to using both the protection fund and its own balance sheet to absorb the losses, making the financial strength of the exchange itself an important part of the recovery process. Reuters reported that Binance held about $162.8 billion in assets under custody at the end of 2025 and had around 335 million registered users globally. More Than $6 Billion Moved Across Ten Blockchains Blockchain intelligence firm TRM Labs said approximately $6.36 billion moved from Binance controlled wallets across ten blockchains, including Ethereum, Bitcoin, Tron, Solana, the XRP Ledger, Arbitrum, Avalanche, Optimism, Base and Polygon. Most of the funds were transferred during a roughly 20 minute period beginning on October 29, with another wave of transactions occurring several hours later. Ethereum represented the largest share of the affected assets, with TRM estimating about $3.79 billion moved from Binance wallets on that network. Bitcoin outflows totalled about 18,270 BTC, worth approximately $1.47 billion at the time, while around $628 million was moved through Tron, $296 million through the XRP Ledger and close to $96 million through Solana. The speed of the withdrawals is one of the most consequential aspects of the attack. Digital asset transactions can settle within minutes, meaning that once an attacker gains authority over a wallet or transaction system, billions of dollars can be moved before a company, regulator or law enforcement agency has time to intervene. This gives cryptocurrency infrastructure a very different risk profile from conventional banking systems, where large transfers can often be delayed, reversed or subjected to several layers of institutional approval. TRM’s analysis suggests that the operation had been prepared well before the theft itself. The firm identified activity beginning at least 36 hours earlier, including small transactions used to fund operator wallets, testing of attack code and a rehearsal before the largest transfers were executed. The firm concluded that the pattern pointed toward a compromise of Binance’s hot wallet signing infrastructure rather than a simple theft of wallet keys. Stablecoin Issuers Froze Billions Within Hours The ability to freeze a substantial portion of the stolen assets became one of the most important developments after the breach. Tether and Circle, which issue the dollar linked stablecoins USDT and USDC, froze large amounts of tokens associated with attacker controlled addresses, while other issuers and blockchain organisations also intervened. TRM estimated that stablecoin issuers and network participants had collectively frozen roughly $2.7 billion, while Binance later said the verified total frozen across the wider response had reached about $3 billion. The response illustrates an important feature of modern cryptocurrency markets that is sometimes obscured by the language of decentralisation. Bitcoin and Ether cannot simply be frozen by a company once they move to an attacker controlled wallet, but centralised stablecoins such as USDT and USDC contain mechanisms that allow issuers to prevent specified addresses from transferring their tokens. This distinction has direct economic consequences. The attacker reportedly moved quickly to exchange freezeable stablecoins for assets that are more difficult for any single institution to block, while also using decentralised lending platforms and trading protocols to reposition part of the stolen funds. TRM said the attacker still controlled more than 420,000 ETH and 18,270 BTC after the early freeze operations, with assets worth billions remaining outside the immediate control of token issuers. The incident therefore demonstrates both the strengths and contradictions of digital asset infrastructure. Blockchain transactions are transparent enough for investigators to trace movements in real time, and stablecoin issuers can intervene rapidly, but assets such as Bitcoin can become extremely difficult to recover once control has passed to the attacker. Investigators Point to North Korea Binance has not publicly identified the perpetrators, but blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a hacking group linked to the North Korean state. TRM said it reached the conclusion using on chain and off chain intelligence and stated: “We make this judgment with high confidence.” The group has previously been linked to major cryptocurrency thefts, including the February 2025 attack on Bybit, which the United States Federal Bureau of Investigation attributed to North Korean actors. The attribution remains an assessment by blockchain intelligence firms rather than a confirmed finding by Binance or law enforcement authorities, but the pattern has added a geopolitical dimension to what would otherwise be treated primarily as a technology and financial security incident. North Korean cyber groups have increasingly targeted digital assets because cryptocurrency can provide access to foreign currency outside conventional banking channels. That has turned exchange security into an issue that sits at the intersection of finance, cybersecurity and international sanctions rather than remaining a narrow problem for crypto companies. Bitcoin and Ether Fell as the Market Repriced Exchange Risk The attack immediately affected cryptocurrency markets. Bitcoin fell to a six week low around $76,000, while Ether dropped to its lowest level in about two months. BNB, the token associated with the Binance platform, also declined, while shares of publicly traded crypto businesses including Coinbase and Strategy fell in United States trading. The market response reflects a risk that extends beyond the value of the stolen assets. Cryptocurrency investors depend heavily on centralised exchanges to buy, sell, custody and convert digital assets, which means the financial health and security architecture of companies such as Binance form part of the market’s underlying infrastructure. A failure at the largest exchange therefore raises questions about counterparty risk even for investors whose own assets were not directly affected. This is especially relevant because cryptocurrency exchanges operate differently from regulated banks in many jurisdictions. Customer protections, capital requirements, deposit insurance and resolution frameworks vary widely, which means users may depend heavily on the financial resources and internal policies of individual platforms when something goes wrong. Binance’s promise to reimburse losses has therefore become part of the market stabilisation process. The company said it would use the SAFU reserve and corporate funds, but investors will be watching its updated Proof of Reserves closely once the remediation process is complete. The Hack Reopens the Custody Debate The attack is likely to revive one of the oldest arguments in cryptocurrency investing: whether users should leave assets on an exchange or hold them directly in private wallets. Centralised exchanges provide liquidity, convenience, trading infrastructure and access to fiat currency, but they also create concentrated pools of assets that can become exceptionally valuable targets for sophisticated attackers. A successful compromise of internal systems can therefore expose billions of dollars simultaneously. Self custody removes part of that exchange risk because users control their own private keys, but it creates another category of risk. Individuals can lose passwords, expose recovery phrases, fall victim to phishing or permanently lose access to wallets without any institution capable of reversing the loss. The Binance breach therefore does not prove that self custody is universally safer. It shows that custody structure determines the type of risk an investor carries. For African crypto users, where digital assets are often used alongside conventional banking and mobile money systems, that distinction is becoming more relevant as cryptocurrency adoption grows. Users who hold assets on foreign exchanges are exposed not only to market volatility but also to the operational, regulatory and financial condition of platforms headquartered outside their domestic legal systems. The $6.3 Billion Figure Changes the Scale of Crypto Security Risk The size of the Binance breach is likely to have consequences beyond the exchange itself because it dramatically raises the financial scale at which cybersecurity failures can occur in digital asset markets. The previous benchmark was the approximately $1.5 billion Bybit attack in February 2025. The Binance incident is more than four times larger if the current estimate remains unchanged, and it occurred against the world’s largest cryptocurrency exchange by trading volume. That makes the incident relevant to regulators as well as investors. Governments evaluating cryptocurrency regulation have generally focused on consumer protection, money laundering, taxation and financial stability. Cyber resilience is now likely to receive greater attention because an exchange failure can move billions of dollars within minutes and trigger losses that may exceed the size of internal protection funds. The attack also raises difficult questions about the concentration of cryptocurrency markets. Binance’s global scale provides deep liquidity and allows users across many markets to transact efficiently, but that same concentration means a breach at one company can affect the entire asset class. Binance has described the incident as a “complex attack” and said it is cooperating with law enforcement and industry partners while preparing a full technical review. The company has promised to publish a detailed post mortem and updated Proof of Reserves once the remediation process is complete. The next phase will therefore be as important as the initial theft. Investors will be watching how much of the remaining assets can be recovered, how quickly withdrawals return to normal, whether the company’s balance sheet absorbs the losses without disruption, and whether the technical investigation confirms that the breach was confined to operational infrastructure rather than exposing a deeper weakness in Binance’s custody systems. For an industry built around the argument that digital assets can move without traditional financial intermediaries, the Binance incident has exposed how much of the crypto economy still depends on the security, solvency and operational competence of a small number of very large intermediaries.