NEW YORK, United States / CryptoWire.AI / – Binance has suspended deposits and withdrawals after a security incident involving unauthorized withdrawals with an estimated total impact of about $6.3 billion. The world’s largest crypto exchange by trading volume disclosed the breach on Thursday, October 29. It said about $3 billion had been frozen on-chain so far. Binance said user funds are safe and that it will cover all losses.
The exchange said the compensation will come from its Secure Asset Fund for Users, known as SAFU, and from company funds. It plans to publish an updated Proof of Reserves once remediation is complete. Binance has revoked the authorisation of the affected address and is working with law enforcement and blockchain intelligence partners to trace the funds. It said it will publish only confirmed figures and urged users to rely on official channels.
The incident is far larger than the roughly $1.5 billion Bybit hack in February 2025, which had been considered the biggest theft in the industry. Early on-chain activity centred on an Ethereum address holding more than $2.3 billion in tokens. It received 28,005.6 ETH from a Binance-labelled wallet and later sent 195,460 ETH, worth about $440 million, to another address. The figures reflect a single address rather than the exchange-wide total.
Compromised laptop gave attacker access
Binance said its initial investigation points to a compromised laptop belonging to a DevOps engineer. The breach allowed an attacker to access a service container and submit unauthorized withdrawal transactions. The exchange said it found no evidence that private keys had leaked. It will share a detailed post-mortem once the investigation is complete. Binance founder Changpeng Zhao said on social media that user funds were safe. Co-founder Yi He said deposits and withdrawals would stay suspended while the exchange works with law enforcement.
Tether and Circle froze stablecoins linked to the incident. Zhao thanked Tether for freezing about $971 million and Circle for about $823 million. Tether later said it had frozen nearly $1.57 billion, while Circle froze more than $800 million, according to Reuters. Ripple froze roughly $200 million. Binance has not broken down its $3 billion frozen total by issuer or asset. A blacklist registry showed Tether’s first freeze request was still pending execution at one stage.
Investigators link attack to North Korea
On-chain investigator ZachXBT said funds stolen from Binance were mixed at the same address as proceeds from the $388 million Bitget hack in September, after moving through THORChain. He said this suggests the same actor is behind both attacks. The Bitget exploit had been attributed to TraderTraitor, a group linked to North Korea. TRM Labs said with high confidence that TraderTraitor carried out the Binance attack.
Chainalysis chief executive Jonathan Levin said the hack was likely carried out by the same group and put the amount stolen at $6.4 billion. Markets fell as the news spread, extending a sharp market decline seen in earlier hacks. Bitcoin dropped about 2% to a six-week low of $77,646 in early Asian trading on Friday. BNB fell more than 8% to $694. Ether fell about 2% to a two-month low of $2,238.76.