Binance hack: The biggest theft in crypto history

​Hackers stole a record $6.3 billion from cryptocurrency exchange Binance. Evidence points to North Korea, while the attack has already triggered a major cryptocurrency market selloff. But what is particularly alarming is how simple the attackers' path to billions of dollars may have been.

A hacked laptop opened the door to billions

On the evening of October 29, huge amounts of cryptocurrency began flowing out of Binance wallets. According to TRM Labs, the attackers stole approximately $6.36 billion across ten blockchains, with most of the funds transferred in just 20 minutes. It was the largest theft in cryptocurrency history, roughly four times the size of the Bybit hack in February 2025.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

According to Binance's preliminary findings, the attackers may have gained access through a compromised laptop belonging to one of the exchange's DevOps engineers. The hackers may have used the device to access an internal service and submit unauthorized cryptocurrency withdrawal transactions. However, investigators found no evidence that wallet private keys had been leaked. Blockaid specialists believe the attackers may have manipulated the transaction-signing system into executing unauthorized instructions.

After discovering the breach, Binance suspended operations and began freezing stolen assets with help from other industry participants. By the morning of October 30, approximately $3 billion had been frozen. Tether blocked more than 1.56 billion USDT, while Circle froze over 800 million USDC. Law enforcement agencies and blockchain analytics firms also joined efforts to trace the stolen funds.

Binance pledged to fully compensate losses using its Secure Asset Fund for Users (SAFU) and company funds. According to the latest update, deposits are operating normally again. The exchange expects to resume withdrawals within 48 hours. Once the investigation is complete, Binance has promised to publish a detailed technical report and updated proof of reserves.

The trail leads to North Korea

The North Korean hacking group TraderTraitor may be behind the Binance attack. Specialists from TRM Labs and Chainalysis reached this conclusion after examining the movement of stolen funds and other details of the breach. Binance itself has not officially identified the attackers.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Blockchain investigator ZachXBT uncovered another connection to previous attacks. According to his findings, funds stolen from Binance were mixed with assets previously taken in an exploit targeting cryptocurrency exchange Bitget. The funds reached the same address after passing through the THORChain protocol. Since the earlier attack had been attributed to TraderTraitor, the investigator suggested that the same hackers were likely responsible for both incidents.

The group has previously appeared in investigations into some of the largest cryptocurrency thefts. In February 2025, hackers stole approximately $1.5 billion in Ethereum from Bybit. The U.S. Federal Bureau of Investigation (FBI) officially attributed that attack to North Korea. North Korean hackers have also been linked to the theft of more than $300 million from Japanese cryptocurrency exchange DMM Bitcoin in May 2024.

One of TraderTraitor's main tactics is social engineering. For example, during the DMM Bitcoin attack, a hacker posing as a recruiter sent malicious code disguised as a technical test to an employee of wallet service provider Ginco. According to the FBI, the resulting access was later used to manipulate a legitimate cryptocurrency transaction request, redirecting funds to wallets controlled by the attackers.

A crisis of confidence in centralized exchanges?

The Binance hack triggered a massive cryptocurrency selloff. Bitcoin fell to $76,460, Ethereum dropped below $2,200, and BNB lost more than 8% in 24 hours. According to CoinGlass, exchanges forcibly closed $1.53 billion in traders' positions over the past day. Of that amount, $1.29 billion came from traders betting on higher prices.

The consequences of the attack also reached the decentralized finance (DeFi) sector. Lending protocol Aave temporarily restricted activity across its markets after the attacker deposited 60 million USDT as collateral and borrowed approximately $44.6 million worth of Ethereum. Users were still able to withdraw funds and repay loans, but new deposits and borrowing were suspended. Meanwhile, AAVE and UNI tokens each lost more than 10% over 24 hours.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Standard Chartered analysts believe the Binance hack could accelerate the shift from centralized exchanges (CEXs) to decentralized platforms (DEXs). Geoffrey Kendrick, the bank's global head of digital assets research, identified Uniswap as one of the potential beneficiaries. According to CoinGecko, spot trading volume on the ten largest DEXs reached 23.5% of the volume recorded by the ten largest CEXs in the second quarter of 2026. The ratio stood at 21.4% in the first quarter.

The biggest threat came from within

The Binance hack demonstrated that stealing billions of dollars does not necessarily require hackers to obtain cryptocurrency wallet private keys. If the preliminary findings are confirmed, compromising an employee's computer may have been enough to gain access to the transaction-signing system. The attack affected ten blockchains despite differences in their architecture and security mechanisms.

For Binance, the biggest challenge will be not only compensating losses but also fixing the vulnerabilities that made such an attack possible. The upcoming technical report will need to explain how a single compromised computer could have opened access to billions of dollars in assets and why the exchange's internal security systems failed to stop the withdrawals.