Binance reports $6.3 billion in assets hit by hack, North Korea suspected

What Binance reported

Binance said on Thursday, 29 October, that digital assets worth about $6.3 billion had been affected by what it called the biggest cyberattack in history. Roughly half of that sum had been frozen with the help of other platforms, and the exchange said it would cover all losses. Its later update put the frozen amount at about $3 billion. Deposits and withdrawals were paused while Binance ran security checks and tried to trace and freeze the stolen funds.

Changpeng Zhao, the founder, no longer runs the exchange but remains its largest shareholder. He first wrote on X that it was a hacker attack and that user funds were safe. Co-founder Yi He thanked several crypto issuers for freezing assets and said withdrawals were suspended until the environment was confirmed safe.

How the breach happened

Binance's early review points to a laptop used by a developer who worked on its systems. The device was compromised, and the attacker reportedly reached an internal services environment and used it to submit unauthorized withdrawal orders. Binance said it had found no sign so far that private keys to digital wallets had leaked, but it cautioned that the attackers may have reached functions that let them move funds another way. How the computer was breached, how access was obtained and which extra safeguard was bypassed remain under investigation. TRM Labs said the attackers targeted Binance wallets across 10 blockchains and moved most of the funds within about 20 minutes.

North Korea link

TRM Labs attributes the attack to TraderTraitor, a hacking group it links to North Korea, and says it reached that conclusion with a high degree of confidence. The firm cited similarities with earlier thefts tied to Pyongyang, including the 2025 hack of the Bybit exchange, which the FBI attributed to North Korea. TRM also reported small transfers through the Tornado Cash service before the attack, preparation that began earlier, and signatures obtained in advance so that transactions could be executed in bulk. Tornado Cash mixes digital funds to make their trail harder to follow, so its use alone is not proof. Pangolin Intelligence reached a similar view, and TRM senior researcher Nick Carlsen told the Wall Street Journal that the firms linked the hackers' blockchain activity to earlier attacks attributed to North Korea. Chainalysis also said it had a high degree of confidence in the link. The North Korean mission in Geneva and its embassy in China did not respond to Reuters requests for comment. Ari Redbord, TRM's head of strategy and policy, told the BBC that the attack is a turning point for the industry with no precedent, and that the attacker still holds large sums, so recovery efforts are far from complete.

Market reaction and next steps

Bitcoin fell more than 3% during Asian trading on Friday, 30 October, to $76,368, its lowest level in six weeks, before recovering. Ether dropped more than 3% to $2,178, a two-month low. Tether and Circle said they had frozen about $2.4 billion in assets after the attack. Zhao had initially cited about $1.7 billion frozen by the two stablecoin providers, and Binance later raised its own frozen figure to $3 billion. Binance did not say what had happened to the remaining $3.3 billion. The exchange expects to resume withdrawal services within 48 hours, and Binance.US said it had not been affected. Aravind Srinivasan, who runs systematic OTC trading at the crypto firm GSR, called it the biggest cyber theft in history. Binance says it is working with law enforcement to identify those responsible and bring them to justice.

Assets affected (Binance estimate)6.3

Frozen with partners' help (latest Binance update)3

Assets affected (Binance estimate)

6.3 USD billion

Frozen with partners' help (latest Binance update)

3 USD billion

Data from the article text