- BIST10010,760-3.63%
- USD49.86+0.15%
- EUR55.82+0.52%
- GOLD3,898.90-3.29%
- INTEREST36.00%-1.00
- BITCOIN77,461+0.33%
- October 31, 202614°
- BIST10010,760-3.63%
- USD49.86+0.15%
- EUR55.82+0.52%
- GOLD3,898.90-3.29%
- INTEREST36.00%-1.00
- BITCOIN77,461+0.33%
- October 31, 202614°
How hackers stole $6.3 billion from Binance in about 20 minutes
The record-breaking theft from Binance unfolded in about 20 minutes after attackers, believed to be North Korea's TraderTraitor unit, got in through an engineer's compromised laptop. About $2.7 billion has been frozen, but roughly $2.4 billion remains out of reach.
The bulk of the largest cryptocurrency theft on record was carried out in about 20 minutes. On the evening of Oct. 29, roughly $6.36 billion in digital assets began flowing out of wallets belonging to Binance, the world's largest crypto exchange, across ten blockchains, according to blockchain analytics firm TRM Labs.
Binance confirmed the security incident, suspended deposits and withdrawals and said it would cover all losses, insisting that user funds were "safe." The theft is about four times the size of the previous record, the $1.5 billion hack of the Bybit exchange in February 2025.
An engineer's laptop
Binance said an initial investigation suggested the attacker was able to make unauthorized transactions after gaining access to an engineer's compromised laptop. The company said it would publish a detailed technical post-mortem once the investigation is complete.
According to TRM, the outflows began at 20:05 UTC. Within minutes, Binance wallets on networks including the XRP Ledger, Ethereum, Bitcoin, Tron and Solana had sent their balances to addresses controlled by a single attacker. A second wave around 23:05 UTC hit wallets on Avalanche and Polygon.
On Ethereum, the attacker used 50 authorizations signed in advance to turn a Binance hot wallet into a sweeper under its control. TRM said this points to a compromise of Binance's hot wallet signing infrastructure.
North Korea suspected
TRM attributed the attack "with high confidence" to TraderTraitor, North Korea's elite hacking unit, which the FBI has blamed for the Bybit theft and which investigators have linked to the Lazarus Group. Binance said it was working with law enforcement to identify those responsible.
"When North Korea steals at this scale, the money funds weapons proliferation and other destabilizing activity. That makes this a global security issue, not just a crypto theft," said Ari Redbord, TRM's global head of policy, who called the attack "unprecedented."
A race to freeze the funds
Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in tokens, and Arbitrum's Security Council froze additional assets, bringing the total frozen to roughly $2.7 billion, according to TRM. Binance put the figure at about $3 billion.
The attacker raced the freezes by selling USDT to market makers and borrowing ether against it, TRM said, and now holds more than 420,000 ETH and 18,270 bitcoin, about $2.4 billion beyond the reach of any issuer.
Market shock
Bitcoin fell about 5% after the theft, dropping below $77,000. Binance founder Changpeng Zhao had earlier said the exchange appeared to have been hacked.
"Any assets held at a centralized exchange are only as safe as the exchange itself, and the larger the exchange's holdings, the larger a target it becomes," said Sean Foley, a crypto markets expert at Macquarie University in Sydney. Hackers stole $2.87 billion in crypto in nearly 150 incidents in 2025, according to TRM.
Stay Updated with Ally Daily
Subscribe to be informed about special news, developments and announcements. We will keep you informed.
By signing up, you agree to our Privacy Policy
