A compromised laptop belonging to a DevOps engineer may have opened the way to siphoning $6.36 billion from Binance wallets across ten blockchain networks. The platform said the access enabled the attacker to reach a service container and send unauthorized withdrawal transactions, but Binance co-CEO Richard Teng warned that the attack was more complex than simply using one person's permissions.
Binance has found no evidence that a wallet private key was leaked and has not attributed responsibility to any employee. The company also reported «additional breach points» and said it is still gathering data to reconstruct what happened.
Withdrawals suspended and funds being tracked
The theft took place on October 29. TRM Labs estimates that the attacker moved approximately $6.36 billion in assets from Binance wallets across ten blockchains. Most of the funds were taken in about twenty minutes, starting at 20:05 UTC. According to TRM, the figure makes this the largest recorded cryptocurrency theft, surpassing the $1.5 billion stolen in the February 2025 Bybit attack by more than four times.
Binance halted deposits and withdrawals while it conducted security checks and revoked authorization for the affected address. RedesZone reported that the platform expected to resume withdrawals within about 48 hours, after renewing the security of the service and related addresses. The company confirmed that deposits were still operating normally; a later update, reported by The Hacker News, said withdrawals remained suspended while the review and secure restoration of the service continued.
The platform says users' funds are safe and has promised to cover the losses using the SAFU fund and its own resources. It also said it would publish an updated version of its proof of reserves once remediation is complete. The commitment to cover the losses comes from Binance: the coverage is not backed by a public deposit guarantee, as The Guardian notes.
Asset issuers and other network participants have frozen nearly $2.7 billion, according to TRM Labs. The firm estimates that Tether, Circle, Ripple, and World Liberty Financial froze about $2.67 billion in stablecoins; the Arbitrum Security Council also immobilized ETH and ARB. Published estimates of the assets still under the attacker's control vary: TRM estimates about $2.4 billion in ETH and BTC, as well as smaller amounts on other networks.
Meanwhile, Binance is working with blockchain analytics firms and law enforcement to trace and recover funds. The company said it is coordinating with partners to confirm the identity of those responsible. It has not yet published a complete root-cause analysis.
TraderTraitor: attribution by analytics firms
Binance has not publicly linked the incident to a specific group. TRM Labs attributes the attack with a high degree of confidence to TraderTraitor, a North Korean hacker unit. Chainalysis agrees with the attribution, according to The Hacker News. The firms point to similarities with previous attacks, including advance preparation of transactions and coordinated movement of funds.
TRM describes access that reached Binance wallets across several networks and says the most likely explanation is that the attacker got the platform's signing infrastructure to authorize operations across multiple chains. On Ethereum, according to TRM's analysis, the attacker prepared 50 signed authorizations so that one would remain valid when executed. A hot wallet—connected to the internet to process withdrawals—then sent its balance to an address controlled by the attacker.
This blockchain analysis offers a technical explanation for the movement of funds, but Binance has not yet publicly confirmed the full mechanism. The company did clarify that the incident was not a «one-click» action and was not limited to an engineer's permissions.
«To be clear: the attacker did not simply use an engineer's permissions, and it was not a “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual».
— Richard Teng, Binance co-CEO
Investigation remains ongoing
Analytics firms have described a conversion pattern that differs from those seen after other thefts. TRM says the attacker sold USDT to market makers and borrowed ETH using USDT as collateral on Aave, while issuers were freezing assets. Chainalysis has also observed movements it describes as unprecedented, with repeated transactions between addresses. The money's future route remains to be seen; TRM is monitoring the funds and expects the assets may pass through exchange services, cross-chain bridges, and over-the-counter brokers.
Binance says it has contained the compromised infrastructure, revoked authorizations, and added controls, as well as strengthened checks on the affected systems. The company is working with internal and external experts to reconstruct the full sequence, identify contributing factors, and decide what measures could prevent a recurrence. In the meantime, withdrawals will remain paused until Binance completes its reviews and validates the integrity of the affected systems.
Sources: BleepingComputer, RedesZone, The Hacker News, TRM Labs, the Guardian
