Binance, the world’s largest cryptocurrency exchange, is investigating a security breach that drained an estimated $6.3 billion from its wallets — a theft so large that investigators and news outlets are already describing it as the biggest crypto heist in history. The exchange said the attack appears to have begun with a compromised laptop belonging to a DevOps engineer, which gave an attacker a way into internal systems and the ability to submit unauthorized withdrawal transactions. In about twenty minutes late on Thursday, October 29, most of the money moved out across multiple blockchains. For an industry that has lived through spectacular collapses and thefts before, the scale of this one is in a different league altogether.
Binance moved quickly to reassure its customers that they will not bear the loss. Co-CEO Yi He said the platform would cover all hacking losses, and the company later told reporters it had set aside more than $6.34 billion in company resources to restore customer balances, with about $5 billion already held in the same token assets that were affected. Withdrawals were paused while security checks continue, with the company indicating service could resume roughly 45 to 48 hours after the halt. Deposits, after an initial suspension described in some early reports, were reported open again in later updates as the investigation widened.
How a Single Laptop Opened the Door
According to Binance’s initial investigation, the compromised DevOps laptop allowed the attacker to reach a service container inside the company’s systems. From there, the attacker could submit withdrawal requests that Binance’s own systems treated as legitimate. The company has stressed what did not happen, at least on the evidence so far: it says it has found no evidence that any wallet private key was leaked or stolen. That distinction matters, because it points to a failure of access and authorization controls rather than a break of the cryptography that protects the wallets themselves.
Co-CEO Richard Teng cautioned against reducing the breach to one careless click. The attacker did not simply use one engineer’s permissions, he said, and the intrusion was not a single one-click action, but a more complex process that the company is still unpicking. Binance also disclosed that a follow-up investigation uncovered additional points of breach, without immediately confirming where they were. Security firm Blockaid described a related pattern in its own on-chain analysis, pointing to key misuse — tricking or compromising a signing system into approving malicious transactions without extracting the underlying key — and reported bundled authorizations targeting a Binance account.
Twenty Minutes, Ten Blockchains, Billions Gone
The speed of the theft is a central part of the story. Blockchain intelligence firm TRM Labs estimated that on October 29 an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in roughly twenty minutes beginning around 20:05 UTC. The haul included bitcoin, ether and large amounts of the USDT and USDC stablecoins, along with smaller tokens. Wallet trackers at one point put more than $5.7 billion sitting in the attacker’s wallets, including nearly $1.5 billion in bitcoin and about $900 million in ether, before funds began to be frozen or moved.
The response across the industry was unusually coordinated, and it blunted part of the loss. Binance said partners had frozen about $3 billion of the stolen assets, separate from the reserves it set aside for customers. Tether and Circle, the issuers of USDT and USDC, froze more than $1.567 billion and $800 million respectively that were linked to the incident, and the Arbitrum Security Council was reported to have frozen about $30.5 million more. Freezing stablecoins does not recover bitcoin or ether, but it can trap a large share of a haul in addresses the attacker cannot spend from — one of the few real levers defenders have once a theft is on-chain for everyone to see.
Investigators Point to North Korea’s TraderTraitor
Binance itself has not publicly attributed the attack to any group, but blockchain analysis firms moved fast and in the same direction. TRM Labs attributed the theft with high confidence to TraderTraitor, a North Korean state-backed hacking unit also tracked as the Lazarus Group and APT38. Chainalysis said it reached the same conclusion with a high degree of confidence, and put its own estimate of the amount stolen at about $5.9 billion at the time of the theft — nearly four times the next largest crypto heist. Elliptic’s chief scientist likewise assessed that North Korea-linked actors carried out the theft, citing similar tradecraft and co-mingling with funds from another attributed hack.
If the attribution holds, the Binance breach fits a pattern that Western governments have warned about for years. TraderTraitor was previously linked to the February 2025 theft of about $1.5 billion from the exchange Bybit, until now the largest crypto theft on record, as well as to a string of earlier exchange and bridge attacks. US officials have long argued that North Korea uses stolen cryptocurrency to fund weapons programmes that sanctions are meant to starve. A single operation worth more than $6 billion at the time of theft would dwarf the revenue of many legitimate industries in the sanctioned state — which is precisely why investigators treat exchange security as a national-security issue, not just a consumer one.
What Happens to Binance Customers Now
For ordinary customers, Binance’s promise is straightforward: losses will be covered from its Secure Asset Fund for Users, known as SAFU, and from company funds, and user balances will be restored. The company said it will publish an updated proof of reserves once remediation is complete, a step that will be closely watched because it is the public evidence behind the reassurance. It also revoked authorizations for the affected addresses and said it is working with blockchain intelligence partners and law enforcement to trace and recover what can still be recovered. A detailed technical post-mortem has been promised once the facts are fully verified.
The wider lesson is uncomfortable for an industry built on the promise that code removes the need for trust. The cryptography, on Binance’s own account, was not broken; a person’s laptop, an internal container and an authorization process were. That is the same human and operational layer that fails in ordinary bank and corporate breaches, transplanted into a system where a successful withdrawal is effectively irreversible within minutes. Exchanges will face renewed calls for stronger withdrawal safeguards, stricter separation of duties and slower, harder-to-abuse paths for moving hot-wallet funds. Until those changes are proven, the largest bank heist in history — as the original report put it — will stand as a reminder that in crypto, the vault can be sound while the door is left guarded by a single compromised machine.
Source: ABC News
