Binance loses $6.3 billion in the biggest cryptocurrency theft
The attackers moved most of the funds out of the exchange’s wallets in about 20 minutes. Analytics firms link the attack to the North Korean group TraderTraitor, and the entry point was allegedly an engineer’s laptop.
On Thursday, 29 October, assets estimated to be worth $6.3 billion were moved out of the wallets of Binance, the world’s largest cryptocurrency exchange. According to BleepingComputer, most of the transfers, carried out across ten blockchains (public ledgers of cryptocurrency transactions), took about 20 minutes. Estimates by analytics firms range from $5.9 to $6.36 billion, depending on the token valuation time. Elliptic estimates that this is probably the largest theft in history.
According to Binance’s preliminary investigation, the attackers took over a DevOps engineer’s laptop (the person responsible for infrastructure and deployments) and used it to reach an internal service approving withdrawals. On Friday, the exchange reported additional points of compromise, and co-CEO Richard Teng stressed that this was not a “one-click” operation. MamStartup writes about a private laptop, but Binance did not confirm whether the device was personal or company-issued. Binance found no evidence that private keys (codes used to sign transactions) were compromised, which indicates that the attackers used authorized paths within the exchange’s systems.
TRM Labs and Chainalysis link the attack to the North Korean group TraderTraitor, which is also blamed for the theft of $1.5 billion from the Bybit exchange in February 2025. Neither Binance nor any government has confirmed this attribution.
The exchange suspended deposits and withdrawals. Around $2.8-3 billion was frozen, mainly in stablecoins (cryptocurrencies pegged to the dollar): Tether blocked about $1.5 billion, and Circle about $800 million. The attackers converted the rest into, among other things, ether, which cannot be blocked. Binance set aside more than $6.34 billion of its own funds to cover customer losses, and co-CEO Yi He announced that withdrawals would be restored within 48 hours from Friday morning.
Experts from ESET and Check Point point out that a similar risk applies to any organization where a single account or device with broad permissions provides access to critical operations. They recommend limiting permissions, independently confirming large transactions, and protecting administrators’ devices.
We cannot assume that no device or access credential will be compromised. No single person or machine should be able to transfer huge amounts on their own without additional verification.