Binance has confirmed a major security breach affecting approximately $6.3 billion in digital assets, with nearly $3 billion frozen as the cryptocurrency exchange works with blockchain networ
Binance has confirmed a major security breach affecting approximately $6.3 billion in digital assets, with nearly $3 billion frozen as the cryptocurrency exchange works with blockchain networks, stablecoin issuers and law enforcement to contain what could become the largest crypto theft on record.
The October 30 disclosure follows suspicious withdrawals totaling an initial $2.77 billion across five blockchains the previous evening. Binance’s preliminary investigation indicates that attackers may have compromised a DevOps engineer’s laptop, gained access to an internal service container and submitted unauthorized withdrawal transactions.
The exchange has temporarily suspended deposits and withdrawals, revoked the affected address authorization and pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and corporate funds.
Binance maintains that customer balances remain protected, although the investigation has not yet established the final recoverable amount or the full extent of the compromise.
The security incident began attracting attention on October 29 when blockchain researchers detected unusually large transfers from Binance-associated wallets to addresses outside the exchange’s publicly identified custody infrastructure.
Subsequent tracing revealed a substantially larger incident. Binance’s October 30 security disclosure placed the estimated impact at $6.3 billion, marking a significant escalation from the preliminary figures.
The suspected entry point was a compromised laptop belonging to a DevOps engineer. Investigators believe the attacker used that access to reach a service container capable of submitting unauthorized withdrawal instructions.
Binance has found no evidence that wallet private keys were directly exposed, suggesting the attack may have exploited internal operational permissions rather than a conventional private-key theft.
Approximately $6.36 billion moved across 10 blockchains during the incident, according to on-chain analysis by TRM Labs, with most of the activity occurring within a roughly 20-minute period beginning at 20:05 UTC on October 29.
The transfers involved Ethereum, Bitcoin, Tron, XRP Ledger and Solana, alongside smaller movements across several other networks.
On Ethereum, investigators identified the use of EIP-7702 account delegation, which allegedly allowed an attacker-controlled contract to redirect funds from a Binance hot wallet. Other affected networks showed conventional signed transactions, raising questions about how the exchange’s internal withdrawal authorization systems were accessed.
The exact relationship between these on-chain techniques and the compromised employee device remains under investigation.
The response involved several major cryptocurrency issuers moving to restrict assets associated with the suspected attacker.
Tether froze more than 1.567 billion USDT connected to the incident, while Circle blocked over 800 million USDC in coordination with investigators.
Ripple also reportedly restricted approximately $200 million in affected assets, while World Liberty Financial froze roughly $27 million in USD1 tokens.
Additional action involved blockchain infrastructure providers, including Arbitrum’s Security Council, which restricted assets connected to the exploit.
Together, these measures contributed to approximately $3 billion in frozen assets, according to Binance’s latest confirmed figures.
Freezing assets prevents them from being transferred through the affected token contracts or networks, but does not necessarily mean the funds have been returned to Binance.
The remaining exposure is substantial. Based on the exchange’s preliminary $6.3 billion estimate, approximately $3.3 billion falls outside the reported frozen amount, although that figure is not necessarily equivalent to the final unrecoverable loss.
Binance has engaged law enforcement, token issuers and blockchain intelligence firms to trace additional funds and prevent further movement.
The exchange has also pledged to replenish any losses using its SAFU emergency reserve and corporate funds, while promising an updated Proof of Reserves once remediation is complete.
The investigation has also raised concerns about possible involvement by North Korean cybercriminals.
TRM Labs attributed the attack to TraderTraitor, a North Korea-linked hacking operation associated with sophisticated cryptocurrency thefts, expressing high confidence in its assessment based on blockchain activity and other intelligence.
The suspected connection is significant given North Korea’s history of targeting cryptocurrency platforms. In February 2025, hackers linked to the country stole approximately $1.5 billion from Bybit in an attack that exposed weaknesses in institutional wallet security.
The latest incident also follows September’s Bitget wallet breach involving $387.5 million, where compromised internal access credentials enabled unauthorized withdrawal commands without directly exposing private keys.
For Binance, the immediate priority remains protecting customer balances, securing operational infrastructure and recovering the affected assets.
Co-founder Changpeng Zhao, who stepped down as chief executive in 2023, acknowledged that the incident appeared to be a hack and expressed confidence that customers would be fully covered.
The incident also weighed on cryptocurrency markets, with Bitcoin falling below $79,000 during the initial reaction and BNB recording a sharper decline as traders assessed potential operational and financial consequences for the exchange.
Binance has not announced a confirmed timetable for restoring deposits and withdrawals.
A full technical post-mortem is expected once the investigation is completed, including further clarification of the attack’s entry point, affected systems and withdrawal authorization failures.
With billions of dollars still subject to tracing and recovery efforts, the final financial impact remains uncertain. The breach is already among the most consequential cryptocurrency exchange security incidents, and its scale could surpass every previously recorded crypto theft if the preliminary figures are confirmed.
The post Binance Hack: $6.3B Affected, $3B in Assets Frozen appeared first on Crypto Adventure.
