Hackers have stolen approximately $6.3 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in what blockchain intelligence firms describe as the biggest cryptocurrency theft on record. Investigators have pointed to a North Korean hacking group as the likely perpetrator.
The attack, which occurred on October 29, targeted Binance wallets across 10 blockchain networks, with most of the stolen assets transferred within approximately 20 minutes. Blockchain security firm TRM Labs estimated the losses at $6.36 billion, making the incident more than four times larger than the $1.5-billion Bybit cryptocurrency heist in February 2025.
TRM Labs attributed the attack with high confidence to TraderTraitor, a sophisticated hacking unit associated with North Korea. Blockchain analytics company Chainalysis also identified the group as the likely perpetrator, citing similarities with previous cyberattacks linked to North Korean operatives. Binance, however, said its investigation had not yet established the identities of those responsible.
Binance initially suspected that a compromised laptop belonging to an engineer had provided the attackers with access to its systems. However, the exchange later disclosed that investigators had discovered additional points of breach. The company said it found no evidence that cryptocurrency wallet private keys had been leaked, although the full technical cause remained under investigation.
The stolen funds were moved through multiple cryptocurrency networks, including Bitcoin, Ethereum, Tron, Solana and XRP. TRM Labs said the attackers appeared to have compromised Binance’s transaction-signing infrastructure, which authorizes withdrawals from its wallets. This suggests that the hackers may have manipulated the system responsible for approving transactions rather than simply obtaining access to individual wallet passwords.
In response, Binance coordinated with cryptocurrency companies and blockchain security partners to trace and freeze the stolen assets. Approximately $3 billion had been located or frozen as of Friday, including funds immobilized by stablecoin issuers Tether and Circle. The status of the remaining assets was still being investigated.
Binance said customer deposits were unaffected but temporarily suspended withdrawals on several networks while security checks continued. The exchange pledged to cover all customer losses using its own resources and protection funds. It expected withdrawal services to resume within approximately 45 hours, according to its latest update reported Friday.
The suspected involvement of North Korea has raised renewed concerns about the country’s growing role in international cryptocurrency theft. Its hacking operations have increasingly targeted digital asset exchanges and financial institutions, with stolen funds believed to provide foreign currency for the heavily sanctioned economy and potentially support its weapons programs, according to security researchers and international authorities.
North Korea’s alleged involvement is not new. In February 2025, hackers stole approximately $1.5 billion from cryptocurrency exchange Bybit in an attack that the United States Federal Bureau of Investigation attributed to North Korean operatives associated with TraderTraitor. The operation was considered one of the largest cryptocurrency thefts before the Binance incident.
North Korea’s Lazarus Group has also been implicated in several major cyberattacks over the past decade. Among the most prominent was the 2014 cyberattack against Sony Pictures Entertainment, which US authorities attributed to North Korean government-backed hackers. The group subsequently became notorious for targeting financial institutions and cryptocurrency platforms.
The Binance breach highlights the growing security risks facing the global cryptocurrency industry, particularly centralized exchanges that hold and manage large amounts of customers’ digital assets. Despite the recovery efforts, the incident raises serious questions about transaction approval safeguards, internal security controls and the ability of cryptocurrency platforms to protect funds against increasingly sophisticated cybercriminals.
Edgardo Hernal started college at UP Diliman and received his BA in Economics from San Sebastian College, Manila, and Masters in Information Systems Management from Keller Graduate School of Management of DeVry University in Oak Brook, IL. He has 25 years of copy editing and management experience at Thomson West, a subsidiary of Thomson Reuters.
- EDGARDO HERNAL
- EDGARDO HERNAL
- EDGARDO HERNAL
- EDGARDO HERNAL
