Binance, the world’s largest cryptocurrency exchange, has reported a major security incident with an estimated impact of $6.3 billion (€5.66 billion). Blockchain investigators say the attacker moved funds across ten networks, making this potentially the largest cryptocurrency theft on record.
Binance said approximately $3 billion (€2.70 billion) in affected assets had been frozen on-chain. The company also pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and corporate funds.
How the attack happened
The incident unfolded on October 29, when billions of dollars in cryptocurrency moved from Binance-associated wallets. According to blockchain intelligence firm TRM Labs, approximately $6.36 billion (€5.72 billion) was transferred, mostly within about 20 minutes. The transfers involved Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. Binance temporarily suspended deposits and withdrawals as a precaution while investigating.
In an update published on October 30, Binance said its initial investigation pointed to a possible compromise of a DevOps engineer’s laptop. This may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions.
The exchange said it had found no evidence that wallet private keys were leaked. It revoked the affected address authorization and began working with law enforcement and blockchain intelligence partners to trace and recover the funds. Binance has promised a detailed technical report after the investigation concludes.
Billions frozen, but funds remain with the attacker
Binance reported that around $3 billion (€2.70 billion) had been frozen. TRM Labs separately estimated that approximately $2.7 billion (€2.43 billion) had been frozen by October 30.
The latter figure includes about $2.67 billion in stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial, as well as assets frozen by Arbitrum’s Security Council.
However, TRM Labs estimated that the attacker still controlled assets worth about $2.4 billion (€2.16 billion), including more than 420,000 ETH and 18,270 Bitcoin. These assets were beyond the reach of the issuers’ freezing mechanisms at the time of the analysis. The figures may change as investigators trace the funds.
TRM Labs points to a North Korean-linked group
TRM Labs attributed the attack, with what it described as high confidence, to TraderTraitor, a hacking group it links to North Korea. This remains the firm’s assessment, rather than a publicly confirmed law enforcement finding.
Its analysis points to a possible compromise of Binance’s hot-wallet signing infrastructure. On Ethereum, the attacker reportedly used an EIP-7702 authorization to make a Binance hot wallet execute code that redirected funds. Transfers on the other nine networks used signed transactions.
The investigation remains ongoing. The final scale of the losses, the precise method used and the identity of those responsible have yet to be established conclusively.
See all the latest news from Greece and the world at Greekreporter.com. Contact our newsroom to report an update or send your story, photos and videos. Follow GR on Google News and subscribe here to our daily email!
