$6.3 billion stolen from Binance in the largest crypto theft on record
Binance put the impact of its October 29 security incident at about $6.3 billion and said it will cover all losses. Analytics firms say the attacker appears to have made the exchange's own systems sign transactions.
Binance, the world's largest cryptocurrency exchange, has put the impact of its October 29 security incident at about $6.3 billion. According to an analysis by blockchain firm TRM Labs, most of the funds left wallets on ten blockchains in about 20 minutes starting at 20:05 UTC. TRM calculates the total at $6.36 billion, and Elliptic at $6.43 billion. Those figures are about four times the $1.5 billion Bybit theft of February 2025, which makes this the largest crypto theft on record. Binance has suspended deposits and withdrawals and says it will cover all losses from its SAFU fund and company funds.
It may have started with a laptop
Binance's initial investigation suggests the entry point may have been a DevOps engineer's compromised laptop. The company said this let an attacker reach a service container and submit unauthorized withdrawal transactions, and that it found no evidence of a wallet private key leak. In a later update it said it had uncovered additional points of breach and described a complex attack. Co-CEO Richard Teng said the attacker did not simply use one engineer's permissions.
Based on onchain data, TRM and Elliptic both assess that the attacker likely got Binance's own systems to sign transactions. TRM says preparation began at least 36 hours before the theft. On Ethereum, the attacker used 50 pre-signed authorizations to hand control of a Binance wallet to its own contract. Wallets using different chains and signing schemes produced valid signatures for the attacker within about half an hour. Binance has not published a root cause and says a technical report will follow once the investigation ends.
How much has been frozen
Binance said frozen assets had reached about $3 billion, while Elliptic had verified $2.84 billion as of October 30. Most of that was frozen by stablecoin issuers such as Tether and Circle. The attacker has moved into ETH and BTC, which cannot be frozen, and still controls billions of dollars. According to Elliptic, Binance has reserved more than $6.34 billion of company funds to cover the losses. The company expects withdrawals to resume within 45 hours and says it will publish an updated proof of reserves after remediation.
Suspicion falls on North Korea
Binance has not attributed the attack. TRM and Chainalysis point with high confidence to TraderTraitor, a North Korea-linked group. Elliptic also considers North Korea-linked actors the likely culprits, while noting that no government has confirmed it. Chainalysis says the laundering shows signs of automation. The company statements we read contain no finding that the attack itself was carried out with AI.
The figures are based on statements dated October 30 and may change as the investigation continues. The account of how the attack worked and the link to North Korea are the analytics firms' own assessments. Independent evaluations and Binance's technical report are worth following.
Sources: TRM Labs, Elliptic, Chainalysis, BleepingComputer
