World

DevOps

Liberty

World Liberty Financial

Billion

Binance has confirmed a major security breach affecting approximately $6.3 billion in digital assets, with nearly $3 billion frozen as the cryptocurrency exchange works with blockchain networks, stablecoin issuers and law enforcement to contain what could become the largest crypto theft on record.
The October 30 disclosure follows <a href="https://cryptoadventure.com/binance-wallets-see-2-77b-outflows-hack-unconfirmed/" rel="noopener noreferrer nofollow">suspicious withdrawals totaling an initial $2.77 billion across five blockchains</a> the previous evening. Binance’s preliminary investigation indicates that attackers may have compromised a DevOps engineer’s laptop, gained access to an internal service container and submitted unauthorized withdrawal transactions.
The exchange has temporarily suspended deposits and withdrawals, revoked the affected address authorization and pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and corporate funds.
Binance maintains that customer balances remain protected, although the investigation has not yet established the final recoverable amount or the full extent of the compromise.
<h2 id="compromised-engineer-laptop-linked-to-6-3-billion-binance-breach">Compromised Engineer Laptop Linked to $6.3 Billion Binance Breach</h2>
The security incident began attracting attention on October 29 when blockchain researchers detected unusually large transfers from Binance-associated wallets to addresses outside the exchange’s publicly identified custody infrastructure.
Subsequent tracing revealed a substantially larger incident. Binance’s <a href="https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7" rel="noopener noreferrer nofollow">October 30 security disclosure</a> placed the estimated impact at $6.3 billion, marking a significant escalation from the preliminary figures.
The suspected entry point was a compromised laptop belonging to a DevOps engineer. Investigators believe the attacker used that access to reach a service container capable of submitting unauthorized withdrawal instructions.
Binance has found no evidence that wallet private keys were directly exposed, suggesting the attack may have exploited internal operational permissions rather than a conventional private-key theft.
Approximately $6.36 billion moved across 10 blockchains during the incident, according to <a href="https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history" rel="noopener noreferrer nofollow">on-chain analysis by TRM Labs</a>, with most of the activity occurring within a roughly 20-minute period beginning at 20:05 UTC on October 29.
The transfers involved Ethereum, Bitcoin, Tron, XRP Ledger and Solana, alongside smaller movements across several other networks.
On Ethereum, investigators identified the use of <a href="https://cryptoadventure.com/eip-7702-explained-the-ethereum-wallet-mega-upgrade/" rel="noopener noreferrer nofollow">EIP-7702 account delegation</a>, which allegedly allowed an attacker-controlled contract to redirect funds from a Binance hot wallet. Other affected networks showed conventional signed transactions, raising questions about how the exchange’s internal withdrawal authorization systems were accessed.
The exact relationship between these on-chain techniques and the compromised employee device remains under investigation.
<h2 id="tether-circle-and-blockchain-partners-freeze-3-billion">Tether, Circle and Blockchain Partners Freeze $3 Billion</h2>
The response involved several major cryptocurrency issuers moving to restrict assets associated with the suspected attacker.
Tether <a href="https://x.com/cz_binance/status/2115915423174853077?a=e5bL9ke9g1ywFfIZvio&amp;s=20" rel="noopener noreferrer nofollow">froze</a> more than 1.567 billion USDT connected to the incident, while Circle blocked over 800 million USDC in coordination with investigators.
Ripple also reportedly restricted approximately $200 million in affected assets, while World Liberty Financial froze roughly $27 million in USD1 tokens.
Additional action involved blockchain infrastructure providers, including Arbitrum’s Security Council, which restricted assets connected to the exploit.
Together, these measures contributed to approximately $3 billion in frozen assets, according to Binance’s latest confirmed figures.
Freezing assets prevents them from being transferred through the affected token contracts or networks, but does not necessarily mean the funds have been returned to Binance.
The remaining exposure is substantial. Based on the exchange’s preliminary $6.3 billion estimate, approximately $3.3 billion falls outside the reported frozen amount, although that figure is not necessarily equivalent to the final unrecoverable loss.
Binance has engaged law enforcement, token issuers and blockchain intelligence firms to trace additional funds and prevent further movement.
The exchange has also pledged to replenish any losses using its SAFU emergency reserve and corporate funds, while promising an updated <a href="https://cryptoadventure.com/proof-of-reserves-for-crypto-exchanges-how-it-works-and-what-it-does-not-prove/" rel="noopener noreferrer nofollow">Proof of Reserves</a> once remediation is complete.
<h2 id="north-korean-hacker-group-linked-to-attack-as-binance-suspends-withdrawals">North Korean Hacker Group Linked to Attack as Binance Suspends Withdrawals</h2>
The investigation has also raised concerns about possible involvement by <a href="https://cryptoadventure.com/community/articles/north-korean-cyber-espionage-in-crypto/" rel="noopener noreferrer nofollow">North Korean cybercriminals</a>.
TRM Labs attributed the attack to TraderTraitor, a North Korea-linked hacking operation associated with sophisticated cryptocurrency thefts, expressing high confidence in its assessment based on blockchain activity and other intelligence.
The suspected connection is significant given North Korea’s history of targeting cryptocurrency platforms. In February 2025, hackers linked to the country stole approximately $1.5 billion from Bybit in an attack that <a href="https://cryptoadventure.com/the-1-5-billion-bybit-heist-how-hackers-pulled-off-the-biggest-crypto-theft-in-history/" rel="noopener noreferrer nofollow">exposed weaknesses in institutional wallet security</a>.
The latest incident also follows September’s <a href="https://cryptoadventure.com/bitget-restores-btc-withdrawals-after-387-5m-breach-as-forensics-continue/" rel="noopener noreferrer nofollow">Bitget wallet breach involving $387.5 million</a>, where compromised internal access credentials enabled unauthorized withdrawal commands without directly exposing private keys.
For Binance, the immediate priority remains protecting customer balances, securing operational infrastructure and recovering the affected assets.
Co-founder Changpeng Zhao, who stepped down as chief executive in 2023, acknowledged that the incident appeared to be a hack and expressed confidence that customers would be fully covered.
The incident also <a href="https://coinmarketcap.com" rel="noopener noreferrer nofollow">weighed on cryptocurrency markets</a>, with Bitcoin falling below $79,000 during the initial reaction and BNB recording a sharper decline as traders assessed potential operational and financial consequences for the exchange.
Binance has not announced a confirmed timetable for restoring deposits and withdrawals.
A full technical post-mortem is expected once the investigation is completed, including further clarification of the attack’s entry point, affected systems and withdrawal authorization failures.
With billions of dollars still subject to tracing and recovery efforts, the final financial impact remains uncertain. The breach is already among the most consequential cryptocurrency exchange security incidents, and its scale could surpass every previously recorded crypto theft if the preliminary figures are confirmed.
The post <a href="https://cryptoadventure.com/binance-hack-6-3b-affected-3b-in-assets-frozen/" rel="noopener noreferrer nofollow">Binance Hack: $6.3B Affected, $3B in Assets Frozen</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Binance Hack: $6.3B Affected, $3B in Assets Frozen

Table of Contents

Crypto Adventure

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!