SINGAPORE/TOKYO/PARIS: Hackers have stolen approximately $6.3 billion (around Rs 5.6 lakh crore) from Binance, the world’s largest cryptocurrency exchange, in what blockchain analysts believe could be the biggest financial theft in history. The October 30 attack has been linked to North Korea by several cybersecurity firms, although Binance said its investigation had not attributed responsibility to any individual.
The massive breach triggered a decline in cryptocurrency prices, forced Binance to temporarily suspend withdrawals and raised fresh concerns about the security of digital assets held on centralised exchanges.
Binance said it would use its own corporate funds to cover the losses and assured customers that their funds remained safe. Meanwhile, stablecoin issuers, including Tether, Circle and World Liberty Financial, moved to freeze a substantial portion of the stolen assets.
According to Reuters, approximately $3 billion of the stolen cryptocurrency had been located by Friday, while the status of the remaining $3.3 billion was still unclear.
The exchange also confirmed that it was working with the Federal Bureau of Investigation (FBI) and the United States Secret Service (USSS) as investigators attempted to establish how the attackers gained access to its systems.
North Korea suspected of carrying out the Binance attack
Blockchain analysis companies have expressed strong confidence that North Korea was behind the theft.
TRM Labs and Chainalysis, two US-based blockchain intelligence firms, identified similarities between the Binance incident and previous major cryptocurrency attacks attributed to North Korean hacking groups.
British blockchain analytics company Elliptic also said it believed North Korea was responsible.
TRM Labs said the attackers appeared to have manipulated Binance’s wallet systems, allowing them to move funds into cryptocurrency wallets controlled by the hackers.
The method reportedly resembled the February 2025 attack on cryptocurrency exchange Bybit, which the FBI attributed to North Korea.
TRM attributed the latest operation to what it described as North Korea’s elite hacking unit.
North Korea has long been accused by the United States, South Korea and cybersecurity researchers of using state-linked cyber operations to generate revenue through cryptocurrency theft, financial attacks and espionage.
The country has repeatedly denied such allegations.
North Korea’s mission in Geneva and its embassy in China did not immediately respond to Reuters’ requests for comment.
Elliptic described the Binance incident as potentially the largest known theft of any kind.
“This incident is almost certainly the single largest known theft of any kind,” the company said.
However, Binance co-CEO Richard Teng said the exchange’s investigation had not established responsibility.
“Our investigation has not attributed responsibility to any individual,” Teng said in a post on X.
Binance suspends withdrawals and promises to cover losses
Following the discovery of the breach, Binance temporarily halted withdrawal services as a precautionary measure.
The company said it expected to resume withdrawals within 48 hours, while its security teams worked to identify the full extent of the attack and prevent further unauthorised transactions.
Binance also announced that it had internally allocated approximately $6.34 billion in corporate funds to cover the losses.
The company did not disclose detailed information about the source or composition of the funds set aside for this purpose.
Binance maintains a $1 billion bitcoin reserve fund, known as the Secure Asset Fund for Users (SAFU), which was established to provide protection for customers in the event of security breaches and other emergencies.
The reported $6.3 billion theft is substantially larger than that reserve fund.
Binance founder Changpeng Zhao also said on X that the company owned shares in SpaceX worth more than $1 billion.
The exchange did not immediately clarify whether these assets formed part of the financial resources being considered to address the breach.
In a statement posted on X, Binance said: “This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it.”
The company also reiterated that customer funds remained safe and that it was cooperating with external partners to freeze the affected cryptocurrency.
Richard Teng sought to reassure users amid concerns about the scale of the incident.
“Your money is safe and we’re covering every loss,” he said.
The company is now facing the challenge of recovering the stolen assets, identifying the attackers and restoring confidence among millions of cryptocurrency users.
FBI and US Secret Service join investigation
Binance is working with US law enforcement agencies to investigate the incident, according to a person familiar with the situation who spoke to Reuters.
The FBI and the United States Secret Service are involved in the investigation.
The agencies are expected to assist in examining the movement of stolen cryptocurrency and identifying the individuals or groups responsible for the breach.
The Financial Services Regulatory Authority in Abu Dhabi, which issued Binance’s main operating licence, also confirmed that it was monitoring the incident.
The regulator said it was engaging closely with the cryptocurrency exchange.
The involvement of multiple agencies and international regulators highlights the cross-border nature of the incident.
Cryptocurrency transactions can move between digital wallets and platforms across different jurisdictions within minutes, making it difficult for investigators to trace and recover stolen assets once funds have been transferred through multiple channels.
Stablecoin companies freeze nearly $2.6 billion
One of the most significant developments following the attack has been the coordinated response from stablecoin issuers and other cryptocurrency companies.
Stablecoins are digital currencies designed to maintain a relatively stable value, usually by being pegged to traditional currencies such as the US dollar.
They are widely used for cryptocurrency trading and transfers, making them an important part of the digital asset ecosystem.
Following the Binance breach, several issuers moved to freeze assets believed to be connected to the theft.
Tether, the company behind the USDT stablecoin, said it had frozen nearly $1.57 billion worth of assets linked to the incident.
Circle, the issuer of USDC, froze more than $800 million.
World Liberty Financial also said it had worked with cryptocurrency custodian BitGo to freeze funds connected to the attack.
Binance co-founder Yi He said approximately $27 million in stablecoins and around $2 million worth of World Liberty tokens had been frozen.
Cryptocurrency company Ripple also froze approximately $200 million in funds, according to Yi.
These actions brought a substantial portion of the stolen assets under restrictions, although freezing cryptocurrency does not necessarily mean the money has been returned to Binance.
The remaining assets could prove more difficult to recover if they have been transferred through multiple wallets or converted into other digital currencies.
The ability of stablecoin issuers to freeze tokens has also highlighted the role that centralised entities can play in responding to cryptocurrency-related crimes.
Cryptocurrency prices fall after the security breach
News of the Binance attack triggered selling pressure across the cryptocurrency market.
Bitcoin fell to a six-week low of $76,368 before prices stabilised.
Ether declined by more than 3%, reaching a two-month low of $2,178.
BNB, the cryptocurrency originally launched as Binance Coin and used for several purposes within the Binance ecosystem, also came under pressure.
According to CoinGecko, BNB was down 5.3% over the previous 24 hours at $699.54.
Shares of publicly listed cryptocurrency exchange companies also faced pressure as investors reassessed the security risks associated with digital asset platforms.
The incident has added to concerns about the cryptocurrency market, which was already facing pressure from higher US interest rates and weaker demand from exchange-traded fund investors.
Tim Sun, senior researcher at HashKey Group, said the breach could further reduce investors’ willingness to take risks.
“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges,” he said.
The scale of the reported theft has also raised questions about the ability of even the largest cryptocurrency exchanges to protect their infrastructure against sophisticated cyberattacks.
Compromised engineer’s laptop may have triggered attack
Binance’s initial investigation suggested that the breach may have originated from a compromised laptop belonging to one of its engineers.
According to the exchange, hackers may have gained access to one of its systems through the employee’s computer before carrying out unauthorised withdrawals.
The attackers reportedly exploited this access to manipulate wallet operations and transfer cryptocurrency into wallets under their control.
Binance said its security team was examining the computer to establish the full sequence of events.
“Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident,” the company said.
Binance subsequently reported that investigators had identified additional points of breach.
The precise technical vulnerabilities and the complete method used by the attackers had not been publicly established at the time of the Reuters report.
The possibility that an employee’s compromised device served as an entry point highlights the importance of cybersecurity measures extending beyond an exchange’s central infrastructure.
Employee devices, internal access controls and authentication systems can all become potential targets for attackers seeking access to financial platforms.
Binance breach adds to growing cryptocurrency thefts
The incident adds to a series of major cryptocurrency thefts reported across the digital asset industry.
According to researchers at TRM Labs, approximately $2.9 billion worth of cryptocurrency was stolen across nearly 150 attacks during 2025.
In September 2026, cryptocurrency exchange Bitget also reported that approximately $350 million worth of digital assets had been stolen from its platform.
The Binance incident, if the reported loss is confirmed, would significantly exceed those individual cases.
Binance has approximately 335 million registered users worldwide and held around $162.8 billion in assets under custody, according to its 2025 annual report.
The size of its customer base and the amount of cryptocurrency held on its platform mean that the consequences of the breach could extend beyond the company itself.
Cristiano Ventricelli, vice-president of digital assets at Moody’s Ratings, said the wider financial and industry implications would depend on the final losses, the counterparties affected and the amount of cryptocurrency recovered.
He also highlighted the importance of determining whether the incident would lead to wider disruption or a loss of confidence across the digital asset ecosystem.
What the Binance hack means for the cryptocurrency industry
The reported $6.3 billion theft has become a major test for cryptocurrency exchange security and the industry’s ability to respond to large-scale cybercrime.
Although Binance has promised to cover the losses using corporate funds, the recovery of stolen assets remains a separate challenge.
The freezing of billions of dollars in cryptocurrency by Tether, Circle, World Liberty Financial and Ripple offers investigators a possible route towards recovering part of the stolen funds.
However, the incident also raises questions about the security of centralised exchanges, employee access systems and the ability of hackers to exploit weaknesses in digital asset infrastructure.
For investors, the episode reinforces the importance of understanding the risks associated with keeping cryptocurrency on trading platforms.
The investigation by Binance, the FBI and the US Secret Service will be crucial in establishing how the attackers gained access, how much of the stolen cryptocurrency can be recovered and whether the breach was part of North Korea’s alleged wider campaign of cryptocurrency theft.