North Korean hackers have been blamed for what is believed to be the largest cryptocurrency theft in history after about $6.3 billion was taken from wallets belonging to Binance.
The world’s largest crypto exchange said it was investigating a major security incident after unauthorised transactions were made from its systems on Thursday.
Binance said its initial investigation suggested a laptop belonging to one of its DevOps engineers may have been compromised, allowing an attacker to access a service container and submit unauthorised withdrawal transactions.
Around $6.3bn of assets were affected, according to Binance, with approximately $3bn frozen so far with the help of blockchain companies and other industry partners.
Blockchain intelligence company TRM Labs said it had attributed the attack with “high confidence” to TraderTraitor, a hacking group linked to North Korea.
Binance has not publicly confirmed who it believes was responsible and said it was working with law enforcement agencies to identify those behind the attack.
TRM said approximately $6.36bn was moved out of Binance wallets across ten different blockchains on 29 October. Most of the theft took place during a period of around 20 minutes beginning shortly after 8pm UK time.
The assets included Bitcoin, Ethereum, XRP, Solana and stablecoins. TRM said 18,270 Bitcoin, valued at about $1.47bn at the time, were transferred from a Binance wallet, while assets worth around $3.79bn were removed through the Ethereum network.
The company described it as the largest cryptocurrency theft on record and said it was around four times the size of the $1.5bn attack on the Bybit exchange in February 2025, which was also attributed to North Korean hackers.
Some of the stolen cryptocurrency was rapidly moved or exchanged in an apparent attempt to make it more difficult to recover.
Stablecoin companies including Tether and Circle were able to freeze large quantities of assets linked to the attack.
Binance said around $3bn had now been frozen on-chain and efforts to trace and recover further funds were continuing.
The company has pledged to cover all confirmed losses using its Secure Asset Fund for Users, alongside its own corporate funds. It said: “User funds are safe.”
Binance has also reserved more than $6.34bn of company funds to cover the incident.
Withdrawals were temporarily suspended while security checks were carried out, Binance later said deposits were operating normally. The exchange said it expected withdrawals to resume within 48 hours.
The company has revoked authorisation for affected addresses and said a full technical report would be published once its investigation was complete.
The scale of the attack has renewed questions over the security of centralised cryptocurrency exchanges.
Bitcoin fell to a six-week low following the breach, while other cryptocurrencies and shares in crypto-linked companies also came under pressure.
TRM said the methods used in the attack shared characteristics with previous operations attributed to TraderTraitor, including extensive preparation before the theft and the use of transactions designed to obscure the movement of funds.
Binance said it was continuing to work with law enforcement, cryptocurrency issuers and blockchain intelligence companies to recover assets and establish exactly how the breach happened.