Binance, the world’s largest cryptocurrency exchange, experienced a $6.3 billion cyber heist on October 29, marking what is likely the biggest digital asset theft in history. The breach involved hackers rapidly emptying funds from wallets used by Binance for transaction processing in a span of approximately 20 minutes, according to a review of blockchain records and statements by the company.
Initial reports from Binance indicated that the attack may have started with a compromised laptop, but a later investigation revealed multiple points of breach within the exchange’s systems. The attackers reportedly gained control over Binance’s “signing infrastructure,” a system authorizing transactions, allowing them to issue instructions that bypassed typical approval processes and drained funds directly from so-called “hot” wallets connected to the internet.
Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to a North Korean hacking group known as TraderTraitor, noting similarities to prior incursions targeting other crypto exchanges, including a $1.5 billion 2025 theft from Bybit. North Korea has consistently denied involvement in such cyberattacks. The stolen assets include a mixture of cryptocurrencies such as Bitcoin, Ether, and major stablecoins like Tether’s USDT and Circle’s USDC.
Because certain stablecoins are issued by entities able to freeze tokens, issuers including Tether, Circle, Ripple, and World Liberty Financial—a company affiliated with the Trump family—have frozen over $2 billion of the stolen funds to halt laundering efforts. However, approximately $2.4 billion in cryptocurrency, primarily Bitcoin and Ether, remain beyond the reach of these interventions, as these decentralized coins cannot be frozen and require cooperation from exchanges or law enforcement for potential recovery.
In response to the breach, Binance promptly suspended deposits and withdrawals while assembling a crisis team of internal experts and external partners to investigate and mitigate the incident. Co-chief executives He Yi and Richard Teng led the company’s public reassurance campaign. He, working from Abu Dhabi while seven months pregnant, emphasized the growing cybersecurity challenges posed by advances in artificial intelligence and acknowledged the company’s shortcomings in earlier security investments.
Binance stated that it has set aside $6.34 billion in reserves to cover losses from the hack and assured customers that no user funds would be lost. The company also planned to resume withdrawal services within days and committed to conducting a comprehensive security review and a proof-of-reserves audit by November 2. Despite the incident, Binance’s founder Changpeng Zhao maintained a confident public stance, communicating directly with followers and industry partners via social media.
The hack sent shockwaves through the crypto markets, leading to declines in major cryptocurrency prices and stock valuations of related firms. Nonetheless, industry observers noted that such large-scale “hot wallet” breaches have historically had limited long-term effects on market confidence.
Law enforcement agencies, including the FBI and the U.S. Secret Service, confirmed their involvement, coordinating with Binance and other partners to trace, freeze, and recover stolen funds. Abu Dhabi's financial regulators, where Binance holds its main operating license, have engaged closely with the company to monitor ongoing developments.
The incident underscores persistent security vulnerabilities within the largely unregulated cryptocurrency space and raises questions about investor protections. Analysts emphasize that despite efforts to integrate digital assets into mainstream finance, crypto remains a high-risk asset class without the safeguards typical of traditional regulated markets. The breach has reignited debates over the need for stronger security measures and clearer regulatory frameworks to protect users in the evolving landscape of digital finance.