The cryptocurrency industry is facing one of the largest security incidents in its history after approximately $6.3 billion in digital assets was moved out of Binance wallets during a sophisticated cyberattack on October 29.
According to Binance's preliminary investigation, the attackers may have initially gained access through a compromised laptop belonging to a DevOps engineer. This potentially allowed them to access an internal service container and submit unauthorized withdrawal transactions.
However, the investigation uncovered additional points of compromise, suggesting that this was a more complex attack than initially believed.
How did the attackers execute the operation?
Blockchain intelligence firm TRM Labs reported that approximately $6.36 billion was moved across 10 blockchains, with most of the operation taking place in roughly 20 minutes.
Investigators believe the attackers compromised Binance's transaction-signing infrastructure, which authorizes withdrawals from affected wallets.
Importantly, Binance has stated that it has found no evidence that wallet private keys were leaked.
North Korea connection
The blockchain intelligence firms TRM Labs and Chainalysis have linked the operation with high confidence to TraderTraitor, a hacking unit associated with North Korea.
Researchers identified similarities with previous attacks attributed to the same group, including the $1.5 billion Bybit hack in February 2025.
Nevertheless, Binance has not officially confirmed the identity of the attackers, and the investigation remains ongoing.
Which assets were affected?
The stolen assets were distributed across multiple blockchains, including Bitcoin, Ethereum and TRON.
Approximately half of the affected assets consisted of stablecoins that could be frozen by their issuers. Meanwhile, Bitcoin and Ethereum present a different challenge because they cannot be remotely frozen by a central issuer.
This incident highlights the growing sophistication of cyberattacks targeting centralized cryptocurrency infrastructure.
The full technical investigation has not yet been published.