Binance has confirmed a major security breach affecting approximately $6.3 billion in digital assets, with nearly $3 billion frozen as the cryptocurrency exchange works with blockchain networks, stablecoin issuers and law enforcement to contain what could become the largest crypto theft on record.

The October 30 disclosure followed suspicious withdrawals totaling an initial $2.77 billion across five blockchains the previous evening. Binance’s preliminary investigation indicates that attackers may have compromised a DevOps engineer’s laptop, accessed an internal service container and submitted unauthorized withdrawal transactions.

The exchange has temporarily suspended deposits and withdrawals—a standard containment step while an active security investigation is underway—revoked the affected address authorization and pledged to cover all losses through its Secure Asset Fund for Users (SAFU), an emergency reserve established in 2018 and funded by a portion of trading fees, and corporate funds. Binance said customer balances remain protected, although the investigation has not yet established the final recoverable amount or the full extent of the compromise.

Compromised Engineer Laptop Linked to Binance Breach

The incident began attracting attention on October 29, when blockchain researchers detected unusually large transfers from Binance-associated wallets to addresses outside the exchange’s publicly identified custody infrastructure. Initial reports described outflows of approximately $2.77 billion (Crypto Adventure).

Subsequent tracing revealed a substantially larger incident. Binance’s October 30 security disclosure placed the estimated impact at $6.3 billion, a significant escalation from the preliminary figures.

The suspected entry point was a compromised laptop belonging to a DevOps engineer. Investigators believe the attacker used that access to reach a service container capable of submitting unauthorized withdrawal instructions. Binance has found no evidence that wallet private keys were directly exposed, suggesting that the attack may have exploited internal operational permissions rather than involved a conventional private-key theft. That distinction matters because it shifts the security question from key custody to the internal authorization systems exchanges rely on to move customer funds—the very systems the investigation has yet to fully explain.

Approximately $6.36 billion moved across 10 blockchains during the incident, according to on-chain analysis by TRM Labs. Most of the activity occurred within a roughly 20-minute period beginning at 20:05 UTC on October 29.

The transfers involved Ethereum, Bitcoin, Tron, XRP Ledger and Solana, along with smaller movements across several other networks. On Ethereum, investigators identified the use of EIP-7702 account delegation, which allegedly allowed an attacker-controlled contract to redirect funds from a Binance hot wallet, the type of internet-connected wallet exchanges rely on to process routine withdrawals. EIP-7702 is an Ethereum mechanism that enables certain account-delegation functions.

Other affected networks showed conventional signed transactions, raising questions about how Binance’s internal withdrawal authorization systems were accessed. The exact relationship between these on-chain techniques and the compromised employee device remains under investigation.

Tether, Circle and Blockchain Partners Freeze $3 Billion

Several major cryptocurrency issuers moved to restrict assets associated with the suspected attacker. Tether froze more than 1.567 billion USDT connected to the incident, while Circle blocked over 800 million USDC in coordination with investigators.

Ripple also reportedly restricted approximately $200 million in affected assets, and World Liberty Financial froze roughly $27 million in USD1 tokens. Additional action involved blockchain infrastructure providers, including Arbitrum’s Security Council, which restricted assets connected to the exploit.

Together, these measures contributed to approximately $3 billion in frozen assets, according to Binance’s latest confirmed figures. Freezing assets prevents them from being transferred through the affected token contracts or networks—a capability that major stablecoin issuers such as Tether and Circle hold at the contract level—but does not necessarily mean the funds have been returned to Binance.

The remaining exposure is substantial. Based on the exchange’s preliminary $6.3 billion estimate, approximately $3.3 billion falls outside the reported frozen amount. That figure is not necessarily equivalent to the final unrecoverable loss, however, because tracing and recovery efforts remain ongoing.

Binance has engaged law enforcement, token issuers and blockchain intelligence firms to trace additional funds and prevent further movement. The exchange has also pledged to replenish any losses using its SAFU emergency reserve and corporate funds, while promising an updated Proof of Reserves once remediation is complete.

North Korean Hacker Group Linked to Attack

The investigation has raised concerns about possible involvement by North Korean cybercriminals. TRM Labs attributed the attack to TraderTraitor, a North Korea-linked hacking operation associated with sophisticated cryptocurrency thefts. The firm expressed high confidence in its assessment based on blockchain activity and other intelligence.

The suspected connection is significant given North Korea’s history of targeting cryptocurrency platforms. In February 2025, hackers linked to the country stole approximately $1.5 billion from Bybit in an attack that exposed weaknesses in institutional wallet security—a theft that had stood as the largest crypto hack on record before this incident. The latest incident also follows September’s Bitget wallet breach involving $387.5 million, in which compromised internal access credentials enabled unauthorized withdrawal commands without directly exposing private keys—a pattern that closely parallels the suspected mechanics of the Binance breach.

For Binance, the immediate priorities remain protecting customer balances, securing operational infrastructure and recovering the affected assets. Co-founder Changpeng Zhao, who stepped down as chief executive in 2023, acknowledged that the incident appeared to be a hack and expressed confidence that customers would be fully covered in a post on X.

The incident also affected cryptocurrency markets, with Bitcoin falling below $79,000 during the initial reaction and BNB recording a sharper decline as traders assessed potential operational and financial consequences for the exchange. Binance has not announced a confirmed timetable for restoring deposits and withdrawals.

A full technical post-mortem is expected once the investigation is completed. It is expected to provide further clarification of the attack’s entry point, affected systems and withdrawal authorization failures.

How much of the remaining roughly $3.3 billion is ultimately recovered, when deposits and withdrawals resume and what the post-mortem reveals will shape how the final scale of the incident is measured. With billions of dollars still subject to tracing and recovery efforts, the final financial impact remains uncertain. The breach is already among the most consequential cryptocurrency exchange security incidents, and its scale could surpass every previously recorded crypto theft if the preliminary figures are confirmed.