SINGAPORE, Singapore — Hackers have stolen approximately $6.3 billion from Binance, the world’s largest cryptocurrency exchange, in what investigators describe as the biggest cryptocurrency theft ever recorded.
Cybersecurity researchers have linked the attack to North Korea, although US authorities have not publicly identified those responsible.
The breach forced Binance to suspend withdrawals while investigators and other cryptocurrency companies worked to prevent the stolen assets from being transferred or converted into cash.
By Friday, October 30, 2026, approximately $3 billion of the stolen cryptocurrency had been frozen, according to Binance, leaving billions of dollars still outside the company’s control.
The exchange has promised to cover the losses using its own resources and an emergency protection fund, insisting that customers’ money remains secure.
Billions Stolen in About 20 Minutes
The theft unfolded on Thursday evening when attackers gained access to digital wallets operated by Binance and transferred cryptocurrency to addresses under their control.
According to TRM Labs, a blockchain intelligence company, approximately $6.36 billion was moved from Binance wallets across 10 blockchain networks.
Most of the transfers occurred within about 20 minutes.
The stolen assets included Bitcoin, Ethereum, and other digital currencies, making the operation considerably larger than previous cryptocurrency thefts.
TRM Labs said the attack was approximately four times the size of the $1.5 billion theft from Bybit, another cryptocurrency exchange, in February 2025.
That earlier attack had been attributed to North Korean hackers by the Federal Bureau of Investigation.
The scale and speed of the Binance breach prompted a coordinated response from cryptocurrency exchanges, blockchain investigators, and companies responsible for issuing digital currencies.
Tether, Circle, and other firms moved to freeze assets associated with the suspicious transactions.
Freezing the digital currencies prevents their further movement but does not necessarily mean that the stolen funds have been returned to Binance.
Investigators Suspect North Korean Hackers
Several blockchain intelligence companies have identified similarities between the Binance breach and previous cyberattacks attributed to North Korean hacking organisations.
TRM Labs said it had linked the operation with high confidence to TraderTraitor, a hacking group associated with North Korea.
The firm said its assessment drew upon blockchain transaction records and intelligence gathered from other sources.
Singapore-based Pangolin Intelligence reached a similar conclusion after examining the movement of the stolen cryptocurrency and comparing the transactions with earlier attacks.
Another investigative company, Chainalysis, told CNN that it had high confidence in the North Korean attribution.
The company said stolen funds were being moved through several blockchain networks, including Bitcoin and Ethereum.
A Pangolin Intelligence analyst, speaking anonymously to CNN, warned that attempts to recover the money could become increasingly difficult as the attackers moved the assets through different financial channels.
“I think the cat and mouse game has barely begun yet,” the analyst said.
The allegations have not been independently confirmed by US law enforcement.
North Korea has previously denied accusations that it sponsors cryptocurrency thefts and other cyberattacks.
American and South Korean officials have repeatedly accused Pyongyang of using cybercrime to obtain foreign currency while facing international economic sanctions over its nuclear weapons programme.
Binance Investigates How Hackers Gained Access
Binance initially reported that the intrusion might have begun through a compromised laptop belonging to one of its engineers.
The company said the breach potentially allowed an attacker to enter part of its computer infrastructure and initiate unauthorised cryptocurrency withdrawals.
However, further investigation identified additional security weaknesses involved in the attack.
Binance co-chief executive Richard Teng said the operation was more complicated than an attacker simply obtaining access to one employee’s computer.
In an update posted on X, Teng said the company had not established the identity of those responsible and had found no evidence that private keys controlling its cryptocurrency wallets had been exposed.
In a subsequent video statement, Teng explained that the attackers had exploited a mechanism within Ethereum’s technology to obtain control over one of Binance’s online wallets.
He said the attackers had also used methods designed to erase evidence of their activities.
Binance has promised to publish a detailed technical report once its investigation is complete.
Exchange Promises to Cover Customer Losses
The company moved to reassure customers as news of the breach spread through cryptocurrency markets.
In an official security announcement, Binance said it would absorb the financial losses through company reserves and its Secure Asset Fund for Users, known as SAFU.
“User funds are safe,” the company said.
Teng subsequently announced that Binance had reserved more than $6.34 billion to cover the affected assets, with approximately $5 billion already available in the same cryptocurrencies involved in the theft.
The company said customer deposits were continuing normally, although withdrawals remained suspended while its security infrastructure was examined and rebuilt.
Binance expected withdrawal services to resume by Sunday, subject to successful completion of security checks.
The exchange also promised to publish updated evidence of its cryptocurrency reserves once the immediate security work was completed.
The company’s assurances have not eliminated questions about how attackers were able to obtain control of wallets containing billions of dollars.
FBI and Secret Service Join Investigation
American authorities have begun working with cryptocurrency companies and other investigators to determine how the attack was carried out and identify those responsible.
The FBI confirmed to CNN that it was coordinating with public and private organisations to examine the breach and its consequences.
The US Secret Service also confirmed that its investigators were collaborating with financial technology companies, including Circle, to identify and freeze stolen cryptocurrency.
The agency said it was coordinating with federal prosecutors and other law enforcement organisations.
The investigation comes as authorities continue to examine the role of North Korean hacking groups in major cryptocurrency thefts.
According to United Nations reports and private cybersecurity investigators, North Korean operations have been linked to billions of dollars in losses suffered by cryptocurrency businesses and financial institutions.
Cryptocurrency Markets React to Record Theft
The Binance breach also affected cryptocurrency prices.
Bitcoin and Ether fell following reports of the theft, although both recovered some of their earlier losses during trading on Friday.
According to CNN, the two cryptocurrencies were trading approximately 2 to 3 per cent lower around midday in Hong Kong.
The incident has renewed attention on the security arrangements used by cryptocurrency exchanges, particularly platforms that hold large quantities of digital assets on behalf of customers.
Unlike conventional financial trading platforms, cryptocurrency exchanges frequently maintain control over wallets containing assets belonging to their users.
That arrangement can create significant exposure when attackers obtain access to systems responsible for approving transfers.
Binance, founded in 2017 by Changpeng Zhao and others, has grown into the world’s largest cryptocurrency trading platform.
Zhao stepped down as chief executive in 2023 after pleading guilty to violating US anti-money-laundering laws. He served a four-month prison sentence and received a presidential pardon from Donald Trump in October 2025.
He remains the exchange’s largest shareholder but no longer manages its daily operations.
For Binance, the immediate task is to restore withdrawals, establish how its security systems were compromised, and recover as much of the stolen cryptocurrency as possible.
Investigators, meanwhile, are attempting to determine whether the record theft was carried out by the same North Korean hacking organisation implicated in previous attacks on the cryptocurrency industry.
