Singapore: Binance, the world’s largest cryptocurrency exchange, is investigating multiple potential points of breach after an attack resulted in an estimated $6.3 billion in unauthorised cryptocurrency transfers, in what blockchain intelligence firm TRM Labs has described as the largest crypto theft on record.
The exchange’s initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which may have allowed an attacker to access an internal service container and submit unauthorised withdrawal transactions. Binance subsequently said it had uncovered additional potential points of breach as it continued examining the incident.
Binance co-CEO Richard Teng has assured customers that their funds are safe and that the company will cover the losses. The exchange said it would use its Secure Asset Fund for Users (SAFU) and corporate funds to meet the financial impact.
The incident unfolded on October 29, when large amounts of cryptocurrency moved from Binance-controlled wallets across multiple blockchain networks to addresses controlled by an attacker. TRM Labs estimated the transfers at approximately $6.36 billion, with most of the funds moved within a short period.
Compromised engineer’s laptop under investigation
Binance’s preliminary findings suggest that the attack may have begun with a compromised DevOps engineer’s laptop.
According to the exchange, the attacker may have used access gained through the laptop to enter a service container and submit withdrawal transactions that had not been authorised by the company.
A DevOps engineer typically works on the systems and processes used to develop, deploy and maintain software. Access to internal infrastructure can therefore create security risks if an employee’s device or credentials are compromised.
Binance said it had found no evidence that wallet private keys had been leaked. This distinction is important because the initial findings point towards possible misuse of the exchange’s transaction-signing infrastructure rather than a confirmed theft of the underlying private keys.
The company has not yet published a complete technical explanation of how the attackers gained access or how the different systems were affected. It has said a detailed post-incident report will follow once the investigation is complete and the facts have been verified.
Binance reports additional potential breach points
The investigation has expanded beyond the initial suspected entry point.
Binance said it had uncovered additional points of breach, indicating that investigators are examining whether more than one weakness or compromised system contributed to the incident.
The precise nature of these additional breach points has not yet been publicly established. The exchange is working to reconstruct the attack path and determine how unauthorised transactions were approved across different blockchain networks.
The scale of the transfers has made the investigation particularly complex. The affected wallets operated across networks with different transaction formats and signing mechanisms.
Binance has engaged law enforcement agencies and blockchain intelligence firms to trace the funds, identify those responsible and coordinate efforts to recover or freeze the affected assets.
Around $3 billion in assets frozen
Binance said it had worked with blockchain partners to freeze approximately $3 billion worth of affected assets on-chain.
The response involved several cryptocurrency and stablecoin companies, including Tether, Circle and Ripple, which took action to restrict the movement of assets linked to the attacker.
TRM Labs estimated that approximately $2.7 billion had been frozen on-chain in its assessment published on October 30. The figure included stablecoins frozen by issuers and assets secured through action by Arbitrum’s Security Council. Binance later reported a verified frozen amount of around $3 billion. The figures reflect different reporting cut-off times and assessments.
Freezing assets can prevent some stolen cryptocurrencies from being transferred or exchanged, particularly when they are held in tokens whose issuers have the ability to blacklist specific addresses.
However, not all cryptocurrencies have the same controls. Assets such as Bitcoin and Ether cannot be frozen by a central issuer in the same way as certain stablecoins.
Blockchain investigators are continuing to monitor the addresses associated with the attack and track the movement of funds that remain beyond the reach of freezes.
TRM Labs points to North Korean hacking group
Blockchain intelligence firm TRM Labs has attributed the attack to TraderTraitor, a hacking group linked to North Korea.
The firm said its assessment was based on on-chain and off-chain intelligence and described its confidence in the attribution as high. It also identified similarities between the Binance incident and earlier attacks associated with North Korean-linked cyber operations.
Among the similarities cited were the preparation of attacker-controlled wallets before the theft, the use of small withdrawals to fund operational addresses and the execution of pre-signed authorisations in a concentrated period.
TRM also compared aspects of the incident with the February 2025 attack on cryptocurrency exchange Bybit, in which approximately $1.5 billion was stolen.
The attribution remains an assessment by TRM Labs. Binance has not publicly confirmed the identity of the attackers and said it is working with law enforcement to establish who was responsible.
How the attack affected Binance wallets
TRM Labs said the attacker moved funds from Binance-attributed wallets across ten blockchain networks, including Ethereum, Bitcoin, Tron, the XRP Ledger, Solana and several Ethereum-compatible networks.
The firm identified a particularly significant mechanism involving Ethereum’s EIP-7702 feature.
EIP-7702 allows an externally owned Ethereum account to delegate certain operations to smart-contract code through a signed authorisation. TRM said the attacker used this mechanism to make an affected Binance hot wallet execute a sweeper contract controlled by the attacker.
A hot wallet is connected to the internet and is used by cryptocurrency exchanges to process transactions, including customer withdrawals. Because it is online, it is an important part of an exchange’s operational infrastructure and requires strong security controls.
TRM’s analysis suggested that the attacker used pre-signed authorisations to gain control over the affected Ethereum wallet’s transaction behaviour and move its assets. The firm also found transfers from Binance wallets on other networks that appeared to have been authorised through valid signatures.
The findings have raised questions about the security of transaction-signing systems and the controls used to approve withdrawals across multiple blockchain networks.
Binance suspends withdrawals as a precaution
Following the discovery of the security incident, Binance temporarily suspended deposits and withdrawals while carrying out security checks.
The exchange also revoked the affected address authorisation and began working with law enforcement agencies and blockchain partners to trace the transactions.
In a subsequent update on October 30, Binance said deposits were no longer affected and were operating normally. Withdrawals remained paused while the company worked on security improvements to the withdrawal service and related addresses. The exchange said it expected withdrawals to resume within 48 hours, subject to the remediation process.
Binance also said it would publish an updated Proof of Reserves after completing the security work. Proof of Reserves is intended to provide information about the assets held by an exchange in relation to customer balances.
Binance promises to cover all losses
Richard Teng has sought to reassure customers amid concerns over the scale of the incident.
Binance said customer funds were safe and that it would cover all losses arising from the security breach through its SAFU fund and company resources.
The SAFU fund was established by Binance as an emergency reserve intended to protect users in extreme situations. The exchange has said it will use this fund alongside corporate resources to meet the financial impact of the incident.
The assurance is significant given the estimated size of the unauthorised transfers. However, the full financial impact and the amount ultimately recovered will become clearer as the investigation progresses.
Binance has also said it will release a detailed technical post-mortem once the facts have been verified.
What the Binance hack means for crypto security
The incident has renewed concerns about the security of centralised cryptocurrency exchanges and the systems used to approve transactions.
It also highlights how a compromise involving internal infrastructure can create risks even when there is no confirmed evidence of private-key theft.
The attack’s scale and the movement of funds across multiple blockchain networks have placed particular attention on employee-device security, access controls, transaction authorisation and monitoring systems.
For cryptocurrency exchanges, the investigation could prompt a closer review of how signing permissions are managed, how internal services communicate and whether transaction approvals are sufficiently separated across different networks.
The Binance incident also demonstrates the importance of cooperation between exchanges, blockchain intelligence firms, law enforcement agencies and cryptocurrency issuers when attempting to trace and freeze stolen assets.
Investigation continues as Binance works to restore services
Binance is continuing to investigate the suspected compromise, including the additional potential breach points identified after its initial assessment.
The exchange has said it will cover the losses and that customer funds remain safe. Meanwhile, blockchain intelligence firms are tracking the stolen assets and assessing the possible involvement of North Korean-linked hackers.
With approximately $3 billion in affected assets reported frozen and a substantial amount still under investigation, the recovery effort remains ongoing.
The full extent of the security weaknesses and the identity of those responsible have yet to be established by Binance. The detailed technical report expected after the investigation should provide a clearer account of how the attack happened and what measures the exchange will take to prevent a similar incident.