Binance is investigating what could be the largest cryptocurrency exchange theft on record after attackers moved roughly $6.3 billion in digital assets from company-controlled wallets. The exchange said the incident affected Binance.com, while customer funds remained safe, and pledged to cover losses. Agence France-Presse reported the theft on October 30.
Binance’s preliminary account points to a compromised laptop belonging to a DevOps engineer. Investigators believe the attackers used access to a service container to submit unauthorized withdrawal transactions, rather than obtaining a wallet private key. The company told BleepingComputer that it had found no evidence of a private-key leak and that the attack involved additional breach points and a more complex approval process than a single employee account.
Blockchain intelligence firm TRM Labs said approximately $6.36 billion left Binance wallets across 10 blockchains, with most of the transfers occurring within about 20 minutes beginning on October 29. TRM Labs and Chainalysis have linked the activity to TraderTraitor, a North Korean group associated with cryptocurrency thefts, although attribution remains an investigative assessment rather than a public law-enforcement finding. Wired’s reporting notes that Elliptic identified overlaps but had not independently made the same attribution.
Binance temporarily suspended deposits and withdrawals while it revoked affected authorizations and worked with blockchain companies and law enforcement. The exchange said approximately $3 billion had been frozen on-chain, though that figure may change as investigators distinguish frozen assets from funds ultimately recovered. Tether and Circle were among the firms reported to have blocked assets connected to the theft. Binance said it would use its emergency reserve and company funds to make customers whole, but it has not published a final loss or recovery accounting.
Users should access Binance only through the official app or by typing the company’s address directly, review transaction history and security settings, and report unfamiliar activity through official support. They should not disclose passwords, authentication codes or recovery phrases to anyone claiming to help, and should treat unexpected requests to “verify” an account or pay a recovery fee as likely follow-on fraud. Customers who encounter related scams should preserve messages, wallet addresses and transaction records for investigators.
