Binance, the world’s largest cryptocurrency exchange, has suffered a security breach involving approximately $6.3 billion in assets, making it one of the largest financial thefts ever recorded.
The attack took place October 29, when hackers gained access to internal systems and transferred billions of dollars in just minutes. Early findings suggest the attackers may have used a compromised employee laptop to reach systems responsible for approving transactions.
Following the incident, Binance temporarily suspended withdrawals while investigators worked to determine how the attackers moved through its infrastructure and recover the stolen funds. The company has also identified additional points of intrusion, with the full extent of the breach still under investigation.
Why It Matters: The Binance hack involved more than stolen credentials, with attackers potentially gaining access to internal infrastructure and using existing approval systems to authorize transactions. The theft of billions in just 20 minutes shows how quickly an intrusion can escalate once attackers get past initial security controls, leaving little time to detect and contain the activity.
- An Employee Laptop May Have Been the Entry Point: An initial investigation identified a potentially compromised laptop belonging to a DevOps engineer. According to Binance, attackers may have used that access to enter a service container and submit unauthorized withdrawal transactions. The company later discovered additional points of intrusion, suggesting the attack involved more than one compromised system. Investigators are still tracing how the attackers moved through its infrastructure, and the initial method of compromise has not been confirmed.
- Hackers Used Existing Approval Systems: Researchers found that the attackers prepared 50 transaction authorizations in advance to account for changes in the wallet’s transaction sequence. Once one authorization became valid, they used it to redirect funds to an account under their control. Binance reported no evidence that private keys were stolen. Instead, investigators believe the attackers gained access to the systems responsible for approving transactions, allowing them to carry out the theft through existing authorization processes.
- Billions Were Stolen in About 20 Minutes: The attack surpassed the $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025, setting a new record for cryptocurrency theft. In response, several organizations worked to freeze the stolen assets, including approximately $1.57 billion through Tether and more than $800 million through Circle. Additional funds were frozen through other providers, bringing the total to nearly $3 billion.
- North Korean Hackers Are Suspected: Security firms TRM Labs and Chainalysis have attributed the attack to North Korean threat actors with high confidence. Investigators identified similarities to previous incidents, including advance preparation, pre-signed transactions and activity connected to earlier thefts. Some of the stolen funds were also traced to addresses associated with a separate attack on Bitget. Although the findings support the suspected connection, researchers have identified differences in how the funds were moved, and Binance has not confirmed who was responsible.
- Security Reviews and Recovery Efforts Are Underway: Binance has allocated approximately $6.34 billion in company funds to cover losses and said customer assets remain protected. The exchange suspended withdrawals while reviewing its transaction systems and related infrastructure, with services expected to resume within 48 hours. The company has also revoked affected authorizations and is working with law enforcement to trace the stolen funds. Its investigation remains ongoing as security teams examine the additional points of intrusion discovered after the initial breach.
Binance pauses withdrawals as hackers suspected of stealing billions in crypto – TechCrunch
Hackers steal $6.3 billion from Binance in record heist blamed on North Korea – Reuters
