Record-scale theft under investigation
Hackers stole about $6.3 billion in crypto assets from Binance in an attack that may be the largest cryptocurrency theft recorded, according to reporting published on October 30. The funds were taken from a company hot wallet, while Binance said customer balances would be protected and losses covered from company resources.
The exchange is working with law enforcement, token issuers, blockchain-analysis companies and other industry partners to trace the transfers and freeze assets. The FBI said it was coordinating with public and private partners to assess the scope and potential effects of the incident. British financial regulators were also monitoring the aftermath.
Binance’s initial account pointed to a compromised laptop used by a development and operations engineer. That access allegedly allowed the attacker to reach a service container and submit unauthorized withdrawal transactions. Co-chief executive Richard Teng said the attacker used a self-destruct function intended to erase tools and traces during the operation, while the company began a broader security review.
Researchers point to TraderTraitor
Blockchain intelligence firm TRM attributed the attack with high confidence to TraderTraitor, a North Korean hacking unit. Other security specialists also assessed that the group was probably responsible. The attribution is an assessment by researchers, not a publicly announced final conclusion by law enforcement.
Analysts observed the stolen assets moving through unfamiliar laundering patterns. Chainalysis said the operators were exchanging stablecoins for assets such as ether that cannot be frozen by a central issuer. That tactic could reduce the time available to issuers and exchanges seeking to stop transfers, although the public ledger also gives investigators a continuing record of the movement.
The attack affected broader crypto markets as traders reassessed custody and counterparty risks. Binance suspended withdrawals during its response but maintained that it could absorb the losses. The promise matters because a theft of this scale could otherwise raise questions about liquidity at a centralized exchange.
Recovery effort continues
The amount ultimately recovered may change as companies identify and freeze addresses connected to the attack. Binance has not presented the initial estimate as the final net loss, and tracing efforts were continuing.
The episode also renews scrutiny of operational security around developer systems. A single compromised engineering device can become a route into higher-value infrastructure when credentials and service access are not sufficiently isolated. Investigators still need to establish the complete intrusion path, determine which controls failed and substantiate the attribution through further evidence.
