Binance, the world’s largest cryptocurrency exchange, is working to restore confidence after hackers stole approximately $6.3 billion in digital assets in what blockchain intelligence firms describe as the largest cryptocurrency theft on record.
The Oct. 30 breach has raised fresh concerns about cryptocurrency security, the growing sophistication of cyberattacks and the vulnerability of digital asset platforms. Binance has pledged to cover all customer losses using company funds, setting aside approximately $6.34 billion to address the incident.
Blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean-linked hacking group. U.S. President Donald Trump confirmed that American authorities were investigating the incident but did not confirm Pyongyang’s involvement.
“We’re looking at that,” Trump told reporters at the White House when asked about possible North Korean involvement.
North Korean Hacking Group Suspected
Binance’s initial investigation suggested the breach may have involved a compromised laptop, although subsequent inquiries uncovered additional “points of breach.”
TRM Labs attributed the attack to TraderTraitor, describing it as an elite North Korean hacking unit. “We make this judgment with high confidence,” the firm said.
According to TRM Labs, attackers transferred approximately $6.36 billion from Binance wallets across 10 blockchains, completing most of the operation within roughly 20 minutes. “Several features of this attack match earlier North Korea-linked heists,” the firm said.
Chainalysis also assessed that TraderTraitor was likely responsible. Binance, however, has not confirmed the identity of the attackers.
A spokesperson said the exchange was “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.”
North Korea has increasingly been linked to cryptocurrency theft as a source of foreign currency amid international sanctions and restrictions on its access to global financial markets. South Korea’s intelligence agency estimated in December 2022 that North Korean hackers had stolen approximately 1.5 trillion won ($1.1 billion) in cryptocurrency and other virtual assets over the preceding five years.
How the Attack Bypassed Binance’s Security
The breach targeted Binance’s internet-connected hot wallets, which facilitate transactions and withdrawals. Unlike cold wallets, which store assets offline, hot wallets remain connected to online systems.
Binance co-CEO Richard Teng said attackers manipulated a transaction approval system, allowing unauthorized transfers without passing through normal security controls.
He described the incident as a complex operation involving multiple attackers, a compromised laptop and malicious software designed to erase evidence of its activity.
The exchange said it had found no evidence that the private keys controlling the affected wallets had been leaked.
Nevertheless, the breach has raised questions about Binance’s internal security safeguards and the effectiveness of its transaction approval procedures.
Binance Freezes $3 Billion and Pledges Full Compensation
Binance said approximately $3 billion in affected assets had been frozen through cooperation with blockchain intelligence firms, law enforcement agencies, cryptocurrency issuers and other industry partners.
The exchange has also allocated more than $6.34 billion in company funds to cover customer losses, going beyond its roughly $1 billion Secure Asset Fund for Users (SAFU) emergency reserve.
However, freezing assets does not automatically mean they have been returned to Binance. Investigators must still complete the recovery process.
Stablecoin issuers, including Tether and Circle, helped freeze affected assets. Unlike Bitcoin and Ether, certain stablecoins can be blocked by their issuers, preventing further transfers.
Approximately $2.4 billion of the stolen funds reportedly consists of Bitcoin and Ether, which cannot be frozen through the same centralized mechanisms.
Ari Redbord, a former federal prosecutor and global head of policy at TRM Labs, described the operation as the “largest bank robbery in human history.”
Investigators Race to Recover Stolen Cryptocurrency
Blockchain investigators are monitoring the movement of stolen assets as efforts continue to prevent attackers from converting them into usable funds.
Criminals can attempt to obscure transactions through cryptocurrency mixing services, which combine digital assets to make their origins harder to trace.
Independent cryptocurrency analyst Garrick Hileman warned that attackers may already be moving some unrecovered funds.
“Like in money laundering, you bring in the stolen goods and launder those through a mixer or tumbler,” he said. “You mix it in with other cryptos, and it’s harder to track.”
The recovery process could take considerable time, particularly for assets that cannot be frozen by cryptocurrency issuers.
Withdrawals Suspended as Markets React
Binance temporarily suspended withdrawals while its technical teams investigated the breach and strengthened security controls. The company said deposits were unaffected and was targeting a resumption of withdrawal services within approximately 34 hours.
It also planned to publish an updated proof-of-reserves snapshot, with initial results expected by Nov. 2.
The hack sent cryptocurrency markets lower. Bitcoin fell to a six-week low of approximately $76,368, while Ether dropped more than 3% to around $2,178. Binance’s BNB token declined approximately 6.4% over 24 hours to around $696, according to Reuters.
The breach also surpassed the $1.5 billion Bybit hack in February 2025, which the FBI attributed to North Korea’s TraderTraitor unit.
For Binance, the immediate challenge is recovering stolen assets, restoring withdrawals and demonstrating that customer funds remain secure. The investigation is ongoing, with the identity of those responsible and the prospects for recovering the remaining cryptocurrency yet to be established.