The world's largest cryptocurrency exchange, Binance, is investigating a security breach estimated to have affected $6.3 billion in digital assets, in an attack that could become the biggest cryptocurrency theft on record.
The incident, detected on Thursday, October 29, has triggered an international effort to trace and freeze the funds, with blockchain intelligence firms pointing to a suspected North Korean hacking group.
Binance says approximately $3 billion of the affected assets have been frozen through cooperation with blockchain partners. However, a substantial portion remains beyond the reach of investigators.
The exchange has pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and company resources.
How the attackers gained access
Binance's preliminary investigation points to a compromised laptop belonging to a DevOps engineer, which may have provided attackers with access to an internal service.
According to co-chief executive Richard Teng, the attackers used that access to submit unauthorised withdrawal transactions.
However, Teng cautioned against viewing the incident as a simple case of an employee's credentials being stolen.
He said the attack involved a more complex process and that investigators had found no evidence that cryptocurrency wallet private keys were exposed.
The company has since revoked affected address authorisations and temporarily suspended withdrawals as it strengthens its security systems.
Binance says it is working with law enforcement agencies and blockchain intelligence specialists to trace the stolen assets.
North Korean hackers under scrutiny
Two cryptocurrency investigation firms, TRM Labs and Chainalysis, have linked the attack to TraderTraitor, a hacking operation associated with North Korea.
TRM Labs said its assessment was based on blockchain transaction patterns and other intelligence gathered during its investigations.
The suspected group has previously been linked to major cryptocurrency thefts, including the $1.5 billion attack on exchange Bybit in February 2025.
That incident had set a record for cryptocurrency theft before the latest Binance breach.
However, the attribution remains an assessment by private intelligence firms rather than a publicly confirmed conclusion by law enforcement.
Binance has not directly confirmed the suspected North Korean connection. It says investigators are working to establish the identities of those responsible.
Crypto companies join efforts to freeze assets
The attack has prompted other major players in the cryptocurrency industry to intervene.
Stablecoin issuers Tether and Circle have frozen substantial amounts of digital assets believed to be connected to the incident.
Tether reported freezing approximately $1.6 billion, while Circle said it had blocked more than $800 million in related assets.
Their intervention has helped prevent some of the funds from being moved or converted.
Other cryptocurrency companies have also been monitoring transactions and working with investigators to limit further losses.
The response highlights how cooperation between exchanges, blockchain investigators and cryptocurrency issuers can help contain the damage caused by large-scale cyberattacks.
Cryptocurrency markets react
The breach has also unsettled cryptocurrency markets, with Bitcoin and other major digital currencies recording declines following reports of the incident.
Bitcoin fell by more than 4 per cent in the immediate market reaction, while Ethereum and Solana also experienced losses.
The incident has renewed concerns about the security of cryptocurrency exchanges, particularly those holding billions of dollars in customer assets.
Binance, founded in 2017, has more than 300 million registered users worldwide and reported holding over $160 billion in assets under custody in 2024.
Its United States affiliate, Binance.US, said its platform was not affected by the incident.
The company has promised to release a detailed technical report once investigations are complete and the facts have been verified.
