Cryptocurrency exchange Binance has disclosed a major security breach involving approximately $6.3 billion in digital assets, potentially making it the largest cryptocurrency theft on record. Blockchain intelligence firm TRM Labs independently traced approximately $6.36 billion in unauthorized transfers across 10 blockchains, with most of the funds moving within roughly 20 minutes beginning at 20:05 UTC on October 29. Binance said approximately $3 billion in affected assets had been frozen through cooperation with blockchain partners, while deposits and withdrawals were temporarily suspended as security teams investigated the incident.

TRM Labs has attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group previously linked to several major cryptocurrency thefts. The firm cited blockchain transaction patterns, preparatory activity, the use of Tornado Cash and pre-signed transactions resembling techniques observed in earlier North Korean operations. The FBI previously identified TraderTraitor as responsible for the February 2025 theft of approximately $1.5 billion from cryptocurrency exchange Bybit. However, U.S. authorities have not publicly confirmed the group's involvement in the Binance breach, and the attribution remains an assessment by private-sector investigators.

Binance's preliminary investigation suggests that an attacker may have compromised a DevOps engineer's laptop, gaining access to a service container capable of submitting unauthorized withdrawal transactions. The company said it found no evidence that wallet private keys were exposed and revoked the affected address authorization as an immediate security precaution. Separately, TRM Labs identified evidence suggesting the attackers obtained access to Binance's hot wallet signing infrastructure, allowing transactions to be authorized across multiple blockchains. The precise method of compromise remains under investigation, with Binance planning to release a technical post-mortem once its findings are verified.

The breach triggered a coordinated response involving cryptocurrency exchanges, stablecoin issuers and blockchain intelligence firms. According to TRM Labs, Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council had collectively frozen approximately $2.7 billion in affected assets as of 00:30 UTC on October 30. Binance subsequently placed the frozen total at approximately $3 billion. Despite those interventions, TRM Labs estimated that the attacker still controlled approximately $2.4 billion in assets beyond the direct freezing authority of token issuers, including substantial holdings of Bitcoin and Ether. Investigators continue tracking the movement and conversion of stolen assets through exchanges, decentralized trading platforms and other blockchain services.

Binance has pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and company funds, maintaining that customer funds remain safe. The exchange has engaged law enforcement and blockchain intelligence partners to trace and recover the stolen cryptocurrency and intends to publish updated Proof of Reserves data following remediation. The incident has also raised broader national security concerns because of its suspected connection to North Korean state-sponsored cyber operations, which U.S. authorities have previously linked to efforts to generate revenue for Pyongyang. The final financial losses, amount recoverable and identities of those responsible have not yet been conclusively established.