The world’s largest cryptocurrency exchange has suffered what could become the biggest cryptocurrency theft in history. Binance is dealing with a massive security breach after hackers stole an estimated $6.3 billion in digital assets from its wallets, forcing the exchange to temporarily suspend withdrawals and triggering an international effort to recover the stolen funds.
The attack, which took place on October 29, has raised fresh concerns about cryptocurrency security, even at some of the world’s biggest digital asset platforms. While Binance has assured customers that their money is safe and promised to cover all losses, blockchain intelligence firms suspect that a sophisticated North Korean hacking group may be behind the incident.
In a significant development, cryptocurrency companies and blockchain partners have managed to freeze approximately $3 billion of the affected assets. However, a substantial amount remains unaccounted for as investigators continue tracking the stolen cryptocurrency.
How did hackers steal $6.3 billion from Binance?
Binance’s initial investigation suggests that the attack may have started with a compromised laptop belonging to one of its DevOps engineers. According to the cryptocurrency exchange, the attackers allegedly used the compromised computer to gain access to an internal service container. This allowed them to submit unauthorised withdrawal transactions and move funds out of Binance’s digital wallets.
In its initial security update, Binance explained that the incident may have involved a compromised engineer’s laptop, which enabled the attacker to access a service container and initiate unauthorised withdrawals.
However, the exchange later revealed that its investigation had uncovered additional points of breach. This suggests that the attack was more complicated than initially understood. Binance co-CEO Richard Teng also cautioned against treating the incident as a simple security failure involving one employee.
In a post on X, Teng said the attack was not a single ‘one-click’ action and involved a more complex process. He added that the investigation had not attributed responsibility to any individual.
Importantly, Binance said it had found no evidence that its wallet private keys had been leaked. The company is continuing to investigate how the attackers gained access and managed to authorise the transactions.
North Korean hackers suspected of carrying out the Binance heist
Although Binance has not officially identified the attackers, several blockchain intelligence firms have pointed towards North Korea. TRM Labs attributed the attack to an elite North Korean hacking unit, citing what it described as strong evidence from both on-chain and off-chain intelligence.
The firm also highlighted similarities between the Binance incident and previous cryptocurrency thefts linked to North Korean cybercriminal groups. Pangolin Intelligence, a Singapore-based blockchain tracking firm, has also pointed towards a North Korean hacking group.
According to an analyst at the firm, the conclusion followed an examination of blockchain transactions associated with the attack and comparisons with information gathered from previous hacking incidents.
The suspected involvement of North Korean hackers has added another layer of concern to the incident. Cybercriminal groups linked to the country have previously been accused of targeting cryptocurrency exchanges and digital asset platforms to steal funds.
However, the attribution remains an assessment by blockchain intelligence firms and has not yet been officially confirmed by Binance.
Cryptocurrency companies freeze $3 billion of stolen funds
As the hackers attempted to move the stolen assets, cryptocurrency companies and blockchain partners began working together to identify and freeze the affected funds. So far, approximately $3 billion worth of cryptocurrency has been frozen, representing close to half of the estimated $6.3 billion loss.
The recovery effort highlights how blockchain transactions, although difficult to reverse, can sometimes be tracked. Certain digital assets, particularly stablecoins, can also be frozen by their issuing companies when suspicious transactions are identified.
The remaining assets are still being tracked as investigators work to prevent the attackers from transferring or converting them through other platforms.
The incident has also demonstrated the importance of cooperation between cryptocurrency exchanges, blockchain analytics companies, stablecoin issuers and law enforcement agencies when dealing with large-scale digital thefts.
Indrani Priyadarshini is a journalist and editorial professional specialising in technology, artificial intelligence, smart cities, green energy, and digital transformation. With over four years of experience in tech journalism and digital media, she is known for turning complex industry developments into clear, engaging, and insightful stories. Her expertise spans reporting, editorial strategy, digital publishing workflows, and in-depth coverage of emerging technologies shaping the future.
