Binance has reported one of the largest cyberattacks in the history of digital assets, with attackers stealing approximately $6.3 billion. According to international news agencies and blockchain analysis firms, most of the money was moved within just 20 minutes, with suspicion falling on a hacking group linked to North Korea.
The attack took place on Thursday 29 October 2026 and became public in the early hours of Friday, causing sharp disruption across the global cryptocurrency market. Binance, the world's largest cryptocurrency exchange by trading volume, confirmed the security incident and estimated its total financial impact at $6.3 billion.
How the attack unfolded
US blockchain analysis company TRM Labs said the attackers transferred approximately $6.36 billion from Binance's digital wallets to addresses under their control, using ten different blockchain networks.
Most of the transactions took place within around 20 minutes, demonstrating the speed and coordination of the operation.
Binance's initial investigation suggested the intruders may have gained access through a compromised laptop belonging to a DevOps engineer, whose work involves developing and operating technological infrastructure. That access reportedly enabled unauthorised cryptocurrency withdrawals.
The company subsequently said its investigation had uncovered additional points of compromise, indicating that the attack was more complex than first thought. According to Binance, investigators had not found evidence that the wallets' private keys had been leaked.
Approximately $3bn frozen
After discovering the attack, Binance worked with industry companies and specialist transaction analysis organisations to trace and freeze the stolen assets.
According to the company's official update, approximately $3 billion had been frozen, preventing the attackers from moving those funds further.
The operation involved Tether and Circle, the issuers of the USDT and USDC stablecoins. Tether announced that it had frozen approximately $1.6 billion, while Circle froze more than $800 million.
The status of the remaining funds was still being investigated, with the authorities and blockchain analysis companies tracking cryptocurrency transfers.
Suspicion falls on North Korean hackers
TRM Labs attributed the attack to TraderTraitor, a group it links to North Korea, citing technical findings and analysis of the stolen funds' movements.
Reuters reported that Chainalysis also linked the attack to North Korean cyber activity. The FBI had previously linked the same group to the February 2025 attack on the Bybit exchange, in which approximately $1.5 billion was stolen.
If the total is confirmed, the Binance attack would become the largest recorded cryptocurrency theft, substantially exceeding the earlier incident.
However, attribution to North Korea remained an assessment by cybersecurity companies and had not been officially confirmed by law enforcement authorities.
Bitcoin falls as markets react
The news put strong pressure on major cryptocurrencies. According to AFP, Bitcoin fell by nearly 5% and Ethereum by around 6%, while BNB, the cryptocurrency associated with Binance's ecosystem, recorded even larger losses.
Binance temporarily suspended withdrawals to carry out security checks. It said deposits were unaffected and that it was working to restore services.
The company also pledged to cover all losses through its SAFU user protection fund and its own corporate resources, maintaining that customers' money was safe. It promised to publish a detailed technical report once the investigation was complete.
The reported scale of the attack has brought the security of major cryptocurrency exchanges back into focus, highlighting their exposure to sophisticated attacks even when advanced safeguards are in place.
