Cryptocurrency exchange Binance has suffered an unprecedented security breach involving $6.3 billion (£4.7 billion) in digital assets, in what investigators believe is the largest cryptocurrency theft ever recorded.
The attack, which unfolded on 29 October 2026, targeted wallets operated by the world’s largest cryptocurrency exchange, with billions of dollars transferred across multiple blockchain networks in a matter of minutes.
Blockchain intelligence firm TRM Labs has attributed the attack with high confidence to TraderTraitor, a North Korean state-linked hacking group, previously connected to major cryptocurrency thefts.
According to TRM Labs, attackers moved $6.36 billion across ten blockchains, with most of the transfers completed within around 20 minutes.
The scale of the incident significantly exceeds the $1.5 billion Bybit hack in February 2025, which had previously been considered the largest cryptocurrency theft on record.
Binance has confirmed a security incident affecting approximately $6.3 billion in assets, although investigations into the precise mechanism and the final financial impact remain ongoing.
In an initial security update, Binance said the incident may have involved a compromised laptop belonging to a DevOps engineer, potentially allowing the attacker to access a service container and initiate unauthorised withdrawal transactions.
The exchange said it had found no evidence that wallet private keys were directly compromised and promised to publish a detailed technical report once its investigation is complete.
Binance temporarily suspended deposits and withdrawals while security checks were carried out, revoked affected authorisations and began working with law enforcement and blockchain investigators to trace the stolen assets.
The exchange has insisted that customer funds remain safe and that any losses will be covered through its Secure Asset Fund for Users (SAFU) and company reserves.
However, the incident has raised questions about how one of the world’s largest cryptocurrency platforms could experience a breach involving such substantial sums.
$3 billion in affected digital assets has already been frozen, following coordination between Binance, blockchain networks and stablecoin issuers.
Companies including Tether and Circle have participated in efforts to prevent stolen tokens from being transferred or converted into other assets.
Despite these measures, investigators believe the attackers continue to control substantial quantities of Bitcoin and Ether.
TRM Labs estimates that more than 420,000 Ether and 18,270 Bitcoin, worth $2.4 billion, remained under attacker control during its initial investigation.
Freezing digital assets can prevent attackers from moving certain tokens, but it does not automatically guarantee that the funds will be recovered or returned to their rightful owners.
Investigators believe preparations for the attack began at least 36 hours before the theft, suggesting a coordinated operation involving advance testing and the preparation of unauthorised transactions.
TRM Labs identified activity involving pre-signed transaction authorisations and the manipulation of Ethereum wallet functionality, alongside transfers across other blockchain networks.
The findings suggest the attackers may have gained access to systems capable of authorising transactions across multiple cryptocurrency networks.
However, the precise technical cause has not yet been independently established, and Binance’s internal investigation remains ongoing.
Ari Redbord, chief policy officer at TRM Labs, described the incident as extraordinary both in scale and in the speed with which the attackers moved assets.
The firm believes the operation demonstrates the increasing sophistication of state-linked cybercriminal groups targeting cryptocurrency infrastructure.
The suspected involvement of North Korea’s TraderTraitor group adds a significant national security dimension to the investigation.
The same organisation was previously linked by US authorities to the February 2025 Bybit attack, highlighting the persistent threat posed by organised hacking operations against digital asset exchanges.
Cryptocurrency markets reacted sharply to news of the breach, with Bitcoin falling towards $77,000, approximately 5% lower over the preceding 24 hours.
Other digital assets also declined as investors reassessed security risks and the potential implications for confidence in centralised cryptocurrency exchanges.
The incident has renewed debate about the protection available to cryptocurrency customers compared with users of conventional banking services.
Although Binance has pledged to cover losses, cryptocurrency holdings generally do not benefit from the same deposit protection arrangements available to eligible bank deposits, leaving customers reliant on exchange security, financial resources and applicable legal protections.
The growing relationship between cryptocurrency markets and traditional financial institutions has also prompted concerns about whether severe disruption within the digital asset sector could have wider financial consequences.
Security researchers have emphasised the importance of stronger access controls, transaction monitoring and protection of operational infrastructure, particularly where compromised employee systems could provide access to high-value financial transactions.
The incident demonstrates that blockchain transaction transparency alone cannot prevent the rapid movement of stolen assets when attackers obtain access to trusted systems.
For investors, the Binance breach represents a major test of confidence in cryptocurrency market infrastructure, with the scale of the theft potentially intensifying regulatory scrutiny and pressure for stronger security standards.
The exchange’s ability to honour its commitment to cover losses, restore normal services and establish the precise cause of the incident will be central to rebuilding confidence.
Attention will now turn to the recovery of frozen funds, the ongoing investigation into the suspected North Korean attackers and Binance’s forthcoming technical post-mortem, as the cryptocurrency industry assesses the consequences of its largest reported security breach.
