Hackers moved about $6. 36bn from Binance wallets on 29 October in an attack that blockchain investigators describe as the largest cryptocurrency theft on record. Binance suspended withdrawals on several networks while investigating and said customer funds would be protected.
The exchange said its initial investigation pointed to a compromised laptop belonging to a DevOps engineer, but later found additional points of breach. Binance said the attack involved unauthorised withdrawals from its hot-wallet infrastructure, which is connected to the internet and used to process customer transactions. The company has not publicly assigned responsibility for the attack and is working with law-enforcement agencies, blockchain investigators, token issuers and other exchanges.
TRM Labs attributed the operation with high confidence to TraderTraitor, a North Korean hacking unit previously linked by US authorities to the $1. 5bn Bybit theft in February 2025. Chainalysis also assessed that TraderTraitor was likely responsible, citing similarities in the on-chain and off-chain activity. The attribution remains an assessment by blockchain-analysis firms rather than a confirmed conclusion by Binance or law enforcement.
Stablecoin issuers and other network operators moved quickly to restrict the funds.
Binance said it had reserved more than $6. 34bn to cover the stolen assets and pledged to reimburse customers for losses. Co-chief executive Richard Teng said the company was continuing its investigation and the recovery effort, while founder Changpeng Zhao said the incident appeared to be a hack. The attacker still controlled about $2. 4bn in bitcoin and ether that cannot be frozen by token issuers, although those assets can be intercepted if they reach exchanges or other services. Bitcoin fell about 5% after news of the breach emerged, adding market pressure to an industry already facing repeated attacks and concerns about the security of centralised crypto platforms.