Binance estimates $6.3bn hack impact as analysts point to North Korea

What Binance disclosed

Binance, the world's largest crypto exchange by trading volume, said on Thursday evening, 29 October (US time), that it had been hit by a security incident. Preliminary findings point to a compromised laptop belonging to one of its engineers, which gave the attacker access to a service container and allowed unauthorised withdrawal transactions to be submitted. The exchange paused deposits and withdrawals, brought in law enforcement and blockchain analytics firms, and began tracing the stolen assets. Binance said user funds were safe and that it would cover all losses from company funds and its emergency asset fund. Yi He, a Binance co-founder and co-head, said on Friday, 30 October, that withdrawals would stay disabled until the environment was confirmed safe, and that they were expected to resume within 48 hours.

Scale and frozen funds

Binance estimated the total impact of the attack at about $6.3bn in its Friday update, and said roughly $3bn had been frozen so far with partners. BBC reported a figure of $6.4bn, saying about half of that had been frozen. Tether and Circle said they had frozen assets worth about $2.4bn combined in response to the potential attack. World Liberty Financial, a crypto firm linked to US President Donald Trump and his family, said it had frozen stolen funds together with its partners. Coinbase said the incident had no effect on it and that it was monitoring the situation. Arkham Intelligence tied digital assets worth close to $6bn, including bitcoin, ether, solana and several stablecoins, to 55 wallet addresses that it said could have been used in the attack.

Who is blamed

Two analytics firms attribute the attack to TraderTraitor, a North Korean hacking group, and Chainalysis also points toward North Korea. TRM Labs said its conclusion rested on strong on-chain and off-chain intelligence, and it attributed the attack to an elite North Korean hacking unit. Pangolin Intelligence, a blockchain tracking firm based in Singapore, reached the same conclusion. One Pangolin analyst, who asked to remain anonymous, said comparing on-chain activity with earlier incidents involving the North Korean unit had identified the source. The same analyst added that North Korea would likely use money laundering networks to try to cash out the stolen funds. Binance declined to comment on the North Korea reports. Ari Redbord, an expert interviewed by the BBC, described the attack as a turning point without precedent in the industry and said the hackers still hold a large share of the stolen assets.

Market reaction

Bitcoin fell after the reports, with the Coindesk index dropping as much as 5.0% and trading 2.9% lower at 78,417 USD when the Polish report was published. Aravind Srinivasan, head of systematic OTC business at market maker GSR, told Reuters it was the largest hack in history. The estimated impact is well above the earlier Bybit hack in February 2025, which cost about $1.5bn. Several people in the crypto industry had pointed to a possible breach hours before Binance confirmed the attack. Binance was founded in China in 2017, has more than 300 million users worldwide, and reported that it oversaw $160bn in assets in 2024.

Binance hack, total impact (Binance estimate)6.3

Bybit hack, February 20251.5

Binance hack, total impact (Binance estimate)

6.3 USD bn

Bybit hack, February 2025

1.5 USD bn

Data from the article text

What comes next

The key figures to watch are how much of the roughly $6bn tied to the attack can be frozen and recovered. Binance has said withdrawals should restart within 48 hours of its update on 30 October. Chainalysis said it is tracking stolen funds moving across several blockchains, including Bitcoin. Whether the attribution to North Korea is confirmed by law enforcement has not yet been reported.