Binance has halted withdrawals following a massive cyber theft that resulted in the loss of approximately $6.3 billion worth of cryptocurrency from its online wallets. This incident has been identified by blockchain-security firm TRM Labs as the largest crypto theft to date.
The exchange has assured its customers that any losses incurred will be compensated through its own funds and the Secure Asset Fund for Users (SAFU) emergency reserve. TRM Labs reported that most of the funds were transferred within a mere 20-minute window on October 29. This incident’s scale surpasses the February 2025 Bybit attack, which was estimated at around $1.5 billion.
To manage the situation, Binance has allocated more than $6.34 billion to cover the impact of this theft. Approximately $5 billion is already in the types of assets affected, while the exchange is in the process of obtaining the remaining tokens, including through over-the-counter transactions.
Furthermore, Binance has successfully frozen about $3 billion of the stolen assets with the assistance of partners and digital currency issuers. It is important to note that while these assets are frozen, they have not yet been recovered and are subject to further verification processes.
Withdrawal Status and Security Measures
In an update on October 30, Binance announced that deposits would continue to function, but withdrawals would remain paused as security checks were conducted. The company anticipates beginning a gradual resumption of withdrawals approximately 34 hours after their announcement, dependent on the completion of these security checks. An updated proof-of-reserves report is expected to be released on November 2.
Investigation into the Breach
Initial investigations by Binance suggested that the breach may have originated from a compromised laptop of a DevOps engineer. The attackers are believed to have exploited access to internal systems to issue unauthorized withdrawal commands. However, Binance later indicated that additional vulnerabilities were identified, and the full timeline of the attack is still under investigation.
While Binance has reported no leakage of private wallet keys, TRM Labs pointed out that the infrastructure used for authorizing online wallet transactions may have been compromised. The ongoing investigation aims to clarify both how the attackers gained access and how they executed the transaction instructions that led to the asset transfers.
TRM Labs has attributed the attack to a group known as TraderTraitor, which has connections to North Korea, based on their analysis. It is noteworthy that Binance has not named the attackers publicly in its communications regarding the incident. Previous incidents, such as the Bybit attack, have similarly been linked to North Korean groups.
Asset Recovery Challenges
The ability to freeze certain assets highlights a significant difference between stablecoins and decentralized cryptocurrencies. Entities like Tether and Circle can halt tokens at designated addresses, while Bitcoin and Ether lack a central issuer with the authority to impose such freezes. Although these assets can be tracked on the blockchain, recovering them relies on the cooperation of various services to identify and stop the transactions. TRM Labs estimates that the attackers currently retain around $2.4 billion in these types of assets.
