The theft began at 20:05 UTC on October 29, shortly after the U.S. stock market closed. According to blockchain analytics firm TRM Labs, attackers moved approximately $6.36 billion out of Binance wallets across ten different blockchains, with the bulk of the funds extracted within 20 minutes. TRM Labs attributed the attack to the North Korean hacking unit “TraderTraitor” with “high confidence.” Jonathan Levin, CEO of Chainalysis, concurred, noting that several features of the attack match previous North Korea-linked heists. Binance has not officially confirmed the attribution to North Korea but stated it is working with law enforcement partners to identify the perpetrators.
The breach appears to have originated from a compromised laptop belonging to a DevOps engineer, a staff member responsible for internal systems. Binance co-CEO Richard Tang stated that the attacker used this access to reach an internal service container and submit unauthorized withdrawal transactions. Tang emphasized that this was not a single “one-click” action but a complex attack process. Crucially, Binance stated there is “no evidence of any wallet private key leak,” indicating a failure in internal custody and process rather than a direct breach of the cryptographic keys securing user funds. However, the company acknowledged that its investigation uncovered “additional points of breach,” suggesting the compromise may have affected more than just the single device.
In response to the theft, Binance and its partners moved quickly to secure the stolen assets. Binance reported that it has frozen approximately $3 billion of the affected assets on-chain. This effort was aided by immediate actions from major cryptocurrency issuers, including Tether, Circle, Ripple, and World Liberty Financial, which froze about $2.7 billion in stablecoins. Circle alone froze over $800 million. Despite these freezes, the attackers retained significant holdings, including 18,270 Bitcoin and more than 420,000 Ethereum, the latter valued at approximately $2.4 billion. Unlike stablecoins, Ethereum and Bitcoin are not issued by a central entity that can freeze transactions, meaning these assets remain in the attackers’ control.
Binance has assured users that their funds are safe and that the company will cover all losses from the incident using its SAFU (Secure Asset Fund for Users) emergency fund and corporate funds. The theft equates to roughly 4% of the $144 billion in assets Binance held prior to the hack. The company pledged to publish a detailed technical post-mortem once the investigation is complete and to release an updated Proof of Reserves after remediation is finished.
The market reaction was immediate. Coinbase shares, trading on the Nasdaq, fell 4.82% in after-hours trading to $152.85, a drop influenced by both the hack and the company’s third-quarter earnings report released the same afternoon. Bitcoin prices also dipped, trading at $78,457 on October 30, down 1.77% over 24 hours. Analysts warn that if the attackers attempt to launder the remaining unfrozen assets through mixers or bridges, it could exert further downward pressure on cryptocurrency prices.
