Binance says $6.3bn stolen in record crypto attack as assets are frozen

The attack began at about 20:05 UTC on 29 October, according to blockchain investigators. Binance puts the value of the cryptocurrency taken from its internet-connected wallets at roughly $6.3 billion. TRM Labs estimates $6.36 billion was moved across ten blockchains, while Elliptic puts the theft at $6.43 billion. Those are differing estimates of the same attack. Both firms say it is the largest cryptocurrency theft on record, more than four times the value of the 2025 Bybit hack.

Binance said around $3 billion of the affected assets had been frozen on blockchains. Elliptic said it had verified $2.84 billion in freezes in its 30 October analysis. Freezing assets can stop an attacker moving them, but it does not mean the money has been returned to Binance. Recovery efforts are continuing.

The exchange has promised to cover the losses using its customer protection fund and company money. It says it has prepared more than $6.34 billion for that purpose, including over $5 billion already available in the corresponding cryptocurrencies. Binance temporarily paused withdrawals for security checks and said it was working to restore them in phases. Its pledge does not establish that customers have already been compensated.

How the attackers gained access remains under investigation. Binance said an early inquiry suggested a compromised laptop might have been involved, but investigators subsequently found additional points of compromise. It said it had found no evidence so far that wallet private keys were compromised. TRM Labs’ analysis points instead to an attacker gaining the ability to make Binance’s wallet-signing systems authorise transfers across different blockchains.

TRM Labs attributes the attack with high confidence to TraderTraitor, a group it links to North Korea. Elliptic also considers North Korea-linked involvement likely, citing similarities to earlier attacks and a small overlap in the handling of stolen funds. Elliptic cautions that laundering networks can serve more than one client, so the overlap does not establish that the same attackers were responsible. Reuters reported that the FBI and US Secret Service were working with partners on the investigation and recovery; neither agency identified a perpetrator in the statements it reported.