Binance Hit by $6.3 Billion Cyberattack in Record Crypto Theft
Cryptocurrency exchange giant Binance has suffered a major cyberattack involving approximately US$6.3 billion (KSh819 billion) in digital assets, in what could become the largest cryptocurrency theft in history.
The incident, which occurred on October 29, 2026, has sent shockwaves through the global cryptocurrency industry, raising fresh concerns about the security of digital assets and the risks associated with major trading platforms.
Blockchain intelligence companies TRM Labs and Chainalysis have linked the attack with high confidence to TraderTraitor, a North Korean hacking group associated with previous major cryptocurrency thefts.
Binance has temporarily suspended withdrawals as investigations continue and promised to cover all losses using its company resources and user protection funds.
How Hackers Accessed Binance’s Systems
Initial investigations by Binance suggest that the attackers may have gained access through a compromised laptop belonging to a DevOps engineer.
The breach reportedly allowed the attackers to access an internal service environment and submit unauthorised withdrawal transactions from Binance wallets.
However, Binance later disclosed that investigators had identified additional points of compromise and that the incident involved a more complex process than initially understood.
The company also said it had found no evidence that cryptocurrency wallet private keys had been leaked.
The attack affected wallets across multiple blockchain networks, with investigators reporting that approximately US$6.36 billion in digital assets had been moved during the incident.
According to blockchain intelligence firm TRM Labs, much of the activity happened within approximately 20 minutes.
North Korean Hacking Group Linked to the Attack
Cybersecurity and blockchain investigation firms have attributed the attack to TraderTraitor, a hacking group linked to North Korea.
The group has previously been associated with major cryptocurrency thefts targeting digital asset companies and exchanges.
TRM Labs and Chainalysis said their investigations identified similarities between the Binance incident and previous attacks attributed to North Korean-linked hackers.
However, Binance has not independently confirmed the identity of the attackers, and investigations involving law enforcement agencies are ongoing.
The suspected involvement of the group has renewed international concerns about organised cybercrime targeting cryptocurrency companies.
Billions of Dollars in Stolen Assets Frozen
Following the attack, cryptocurrency companies and blockchain security organisations moved quickly to trace and freeze affected digital assets.
Tether, the company behind USDT, froze approximately US$1.57 billion linked to the incident, while Circle, which issues USDC, froze more than US$800 million.
Other companies, including Ripple and additional digital asset partners, also participated in efforts to restrict the movement of affected funds.
Reuters reported on October 30 that approximately US$2.54 billion had been frozen, while Binance’s own latest update placed the verified total at around US$3 billion. The figures reflect different reporting updates as investigations continue.
Despite these efforts, investigators believe that a substantial amount remains under the attackers’ control.
The recovery process remains complicated because some cryptocurrency assets cannot be frozen by a central issuer in the same way as certain stablecoins.
Binance Promises to Cover All Customer Losses
In response to the incident, Binance assured customers that their funds would remain protected and that the company would cover all losses resulting from the attack.
The exchange said it would use its Secure Asset Fund for Users (SAFU) alongside company resources to meet its commitment.
Binance also temporarily suspended withdrawals while its security teams reviewed the affected systems and worked to restore normal services.
In an update published on October 30, the company said deposits were operating normally, although withdrawals remained paused as security improvements continued. It expected withdrawals to resume within approximately 48 hours of its update.
The company also promised to publish a detailed technical report and an updated proof of reserves after completing its investigation.
Bitcoin and Other Cryptocurrencies React to the News
The Binance security breach has also affected sentiment across the cryptocurrency market.
Bitcoin recorded a decline of more than 4% amid the market reaction, while Ethereum and Solana also experienced downward pressure.
The incident has raised concerns among investors about the security of digital asset exchanges, particularly platforms responsible for holding and managing large amounts of customer funds.
Although cryptocurrency prices can fluctuate for several reasons, a major security incident involving one of the world’s largest exchanges can contribute to uncertainty across the market.
Binance.US, the American affiliate of Binance, said its platform was not affected by the incident.
Coinbase also confirmed that its systems were unaffected and that it was monitoring developments.
Could This Become the Biggest Cryptocurrency Theft in History?
The estimated US$6.3 billion loss could make the Binance incident the largest cryptocurrency theft ever recorded, surpassing the approximately US$1.5 billion stolen during the 2025 Bybit attack.
The scale of the incident has placed renewed attention on cybersecurity across the digital asset industry.
Cryptocurrency exchanges handle enormous volumes of transactions and must maintain strong security systems to protect customer funds against increasingly sophisticated attacks.
The Binance breach also highlights the importance of internal security, employee protection and the monitoring of unusual activity within financial technology companies.
As investigations continue, the focus remains on recovering the affected assets, identifying those responsible and restoring confidence among Binance customers.
For now, Binance says it will take responsibility for the losses, while cybersecurity firms and other industry partners continue working to trace the stolen funds.
