Cryptocurrency exchange Binance has suffered the biggest reported digital asset theft in history after hackers transferred approximately $6.3 billion from its wallets in a coordinated attack, with most of the funds moved within just 20 minutes on Thursday.
Blockchain intelligence firm TRM Labs estimated that attackers transferred around $6.36 billion across 10 blockchain networks, exploiting what investigators believe was a compromise of the exchange's transaction-authorisation infrastructure. The breach dwarfed the $1.5 billion theft from cryptocurrency exchange Bybit in February 2025, previously considered the industry's largest hack.
Binance acknowledged the security incident and said its preliminary investigation had identified a potentially compromised laptop belonging to a DevOps engineer. The breach may have allowed attackers to access a service container and initiate unauthorised withdrawal transactions, although the company said its investigation remained incomplete.
How the 20-minute heist unfolded
According to TRM Labs, the attack began around 20:05 UTC on October 29, when cryptocurrency started leaving Binance-controlled wallets. Within minutes, funds were transferred through networks including Ethereum, Bitcoin, Solana, Tron and the XRP Ledger to addresses controlled by the attackers.
Investigators found that the attackers had apparently prepared the operation in advance, allowing them to execute multiple transactions in rapid succession. On Ethereum, they allegedly used a transaction-authorisation mechanism to redirect funds from a Binance wallet, while other networks recorded transfers carrying valid digital signatures.
A second wave of suspicious transfers occurred later, affecting additional wallets. Investigators believe the coordinated nature of the withdrawals suggests that the attackers had gained access to systems responsible for approving transactions rather than merely exploiting a single wallet.
Binance said it had found no evidence that wallet private keys had been leaked. The company has promised to publish a detailed technical account once the investigation establishes how the breach occurred.
North Korean hackers suspected
TRM Labs attributed the attack with high confidence to TraderTraitor, a hacking unit linked to North Korea. The firm said the operation displayed similarities to earlier cryptocurrency thefts associated with the group, including the Bybit breach.
Investigators identified signs of advance preparation, suspicious funding transactions and the rapid execution of previously authorised transfers. Other blockchain analysis companies also pointed to possible North Korean involvement, although Binance has not publicly confirmed the identity of the attackers.
The allegations come amid longstanding concerns about state-linked cybercrime targeting cryptocurrency platforms. Blockchain investigators and US authorities have previously connected North Korean hacking operations to large-scale digital asset thefts.
Nearly $3 billion in stolen assets frozen
The exchange said it had worked with blockchain companies and cryptocurrency issuers to freeze approximately $3 billion in affected assets. Firms including Tether and Circle moved to block transfers involving stolen stablecoins, limiting the attackers' ability to use or exchange those holdings.
However, investigators warned that substantial amounts had already been converted into cryptocurrencies such as Bitcoin and Ether, which cannot be frozen by a central issuer. TRM Labs estimated that attackers controlled more than 420,000 Ether and 18,270 Bitcoin, representing approximately $2.4 billion in assets beyond the reach of such freezing measures.
Investigators also identified attempts to move funds through cryptocurrency trading and lending platforms, complicating efforts to trace and recover the proceeds.
Binance promises to protect customer funds
Binance temporarily suspended withdrawals while carrying out security checks, revoked affected transaction authorisations and engaged law enforcement agencies and blockchain investigators.
The company said it would cover losses through its Secure Asset Fund for Users (SAFU) and its own financial resources. It maintained that customer funds remained safe and clarified that deposits continued to operate normally.
The incident also unsettled cryptocurrency markets, with Bitcoin and Ether recording declines as investors assessed the scale of the breach and its implications for exchange security.
The attack has raised fresh questions about the safeguards protecting cryptocurrency exchanges, particularly the systems used to authorise transfers from online wallets. While efforts to recover the stolen assets continue, the breach has exposed the potentially enormous consequences of a single compromise within a major digital asset platform.