Binance Estimates $6.3B Impact From Potential Record Crypto Hack

Binance estimated the impact of a security incident at about $6.3 billion on 30th October, saying an attacker may have used a compromised employee laptop to submit unauthorised withdrawals. The exchange said roughly $3 billion in affected assets had been frozen on-chain.

The scale could make this the largest cryptocurrency hack on record if the estimated impact is confirmed as stolen funds.

In a 30th October blog post, Chainalysis attributed the attack to North Korea’s TraderTraitor group, saying funds stolen from Binance had mixed with funds from September’s Bitget theft. TRM Labs’s blog analysis attributed it to the same group with high confidence. Chainalysis put unauthorised transfers at approximately $6.4 billion, while TRM counted $6.36 billion across ten blockchains.

Chainalysis reported approximately $2.8 billion frozen through efforts involving token issuers, investigators and law enforcement, alongside Binance’s roughly $3 billion estimate. TRM’s recovery account includes Arbitrum’s Security Council, a group with emergency powers on the network, moving approximately 74.6 million Arbitrum (ARB) tokens and 8,426 Ethereum (ETH) out of the attacker’s reach. TRM valued that intervention at about $30 million.

In its security update, Binance said the possible entry point was a laptop belonging to a DevOps engineer, who works on software development and operations. Its preliminary account describes an attacker gaining access to a service container, a running software environment, and submitting withdrawals without authorisation.

The scale could make this the largest cryptocurrency hack on record if the estimated impact is confirmed as stolen funds.

Binance said it had found no evidence that wallet private keys, the secret keys used to sign transactions, had leaked. Its proposed explanation therefore concerns access to systems used to submit transactions, rather than a demonstrated theft of the keys themselves. Binance said it would publish a detailed technical account once the investigation was complete.

The exchange said it had revoked the affected address’s authorisation and temporarily suspended deposits and withdrawals during security checks. It also described a tracing effort involving law enforcement bodies and specialist blockchain investigators. The announcement gave no time for services to resume.

Binance pledged to meet losses using its Secure Asset Fund for Users (SAFU), a fund for user protection, and corporate money, and to publish updated evidence of its reserves after remediation. Frozen assets are restricted assets; they are not evidence that customers have received repayments. Neither the headline impact estimate nor the freeze figure establishes a final net loss after recovery.

As of 31st October, Binance’s latest update said it had set aside more than $6.34 billion in company funds to cover the losses, including $5 billion already held in the same tokens that were stolen. It is buying the remaining tokens through market purchases and over-the-counter (OTC) deals. These funds will replace affected assets while efforts to recover roughly $3 billion frozen on-chain continue. The exchange said deposits remain operational, with withdrawals planned to reopen in phases after security checks, and targeted 2nd November for updated Proof of Reserves results.