Hackers drained digital wallets across ten blockchain networks in minutes, exposing weaknesses in transaction security as billions remain at risk of laundering.
Binance, the world’s largest cryptocurrency exchange, resumed customer withdrawals on Sunday, November 1, after hackers stole approximately $6.36 billion from its digital wallets on October 29 in the biggest cryptocurrency theft on record. The FBI has attributed the attack to a North Korean hacking unit, while Binance says it has replaced 95% of the affected assets using company funds. The exchange has yet to establish the full cause of the breach or recover all the stolen cryptocurrency.
The theft, concentrated in approximately 20 minutes, affected ten blockchain networks and exceeded the previous record $1.5 billion attack on Bybit in February 2025 by more than four times.
The incident has raised fresh questions about the security of cryptocurrency exchanges, which hold enormous pools of customer assets and depend on sophisticated digital systems to authorise transactions.
How the attack began and was discovered
According to US blockchain intelligence firm TRM Labs, preparations began at least 36 hours before the theft. On October 28, hackers transferred small cryptocurrency amounts through Tornado Cash, a service that obscures the origin of transactions, before testing malicious software on several digital wallets.
The first confirmed unauthorised transfers occurred on October 29 at approximately 20:05 UTC, when five Binance wallets on the XRP Ledger sent 233.46 million XRP, worth about $296 million, to an attacker-controlled address.
Within minutes, withdrawals spread across Bitcoin, Ethereum, Tron, Solana and other networks. At approximately 20:20 UTC, attackers transferred 18,270 Bitcoin, valued at $1.47 billion, while another major transaction drained substantial holdings from an Ethereum wallet.
Further unauthorised transfers continued during the evening, including a second wave affecting Avalanche and Polygon.
The theft was subsequently reconstructed through publicly visible blockchain transaction records, which allowed investigators to identify affected wallets, trace stolen funds and establish the attack’s sequence. Binance has not disclosed precisely when its internal security systems first detected the intrusion.
How hackers breached Binance’s security
Binance initially reported that the attack might have originated through a compromised laptop belonging to a DevOps engineer, potentially allowing intruders to enter an internal software service and submit unauthorised withdrawal instructions.
However, subsequent investigations uncovered additional points of compromise, indicating that the intrusion was more complex than a single infected computer.
TRM Labs identified evidence that hackers had manipulated Ethereum’s EIP-7702 transaction-authorisation functionality, which allows a digital wallet to delegate transaction execution to a smart contract — software that automatically performs specified operations.
Using previously obtained authorisations, the attackers redirected a Binance hot wallet, an internet-connected account used to process cryptocurrency transfers, towards malicious software under their control.
This enabled them to move large quantities of cryptocurrency and repeatedly withdraw additional funds entering the compromised wallet.
Investigators also identified apparently valid but unauthorised transfers across other blockchains using different signing systems. TRM concluded that the attackers probably gained access to Binance’s broader transaction-signing infrastructure, rather than exploiting a fundamental weakness in the blockchains themselves.
Binance co-chief executive Richard Teng described the operation as a complex attack involving malware designed to erase evidence.
The exchange says it has found no evidence that wallet private keys — the cryptographic credentials used to control digital assets — were leaked. No theft of customer identity databases has been publicly confirmed, although the wider investigation remains incomplete.
The established loss concerns cryptocurrency assets and compromised transaction-authorisation capabilities.
What was stolen and how Binance responded
TRM Labs estimates that approximately $3.79 billion was stolen through Ethereum, $1.47 billion through Bitcoin, $628 million through Tron, $296 million through the XRP Ledger and $96 million through Solana. Smaller losses affected Arbitrum, Optimism, Base, Avalanche and Polygon.
Following the breach, Binance suspended withdrawals, isolated compromised infrastructure, revoked affected authorisations and strengthened security checks. Customer deposits continued operating.
Working with US law enforcement, blockchain investigators and cryptocurrency issuers, Binance reported that approximately $3 billion in stolen assets had been frozen.
Stablecoin issuers including Tether, Circle and Ripple blocked transfers involving compromised tokens, limiting the hackers’ ability to move or exchange substantial amounts.
However, freezing digital assets does not mean they have been legally recovered or returned.
In its initial assessment, TRM Labs identified more than 420,000 Ether and 18,270 Bitcoin, then valued at approximately $2.4 billion, under attacker control and beyond the direct freezing authority of stablecoin issuers. The current recoverable balance remains uncertain as investigators continue tracing transfers.
FBI identifies North Korean operation
On October 31, the FBI formally attributed the theft to TraderTraitor, a North Korean state-sponsored hacking operation previously linked to the February 2025 Bybit attack.
The agency said investigators had observed stolen cryptocurrency being converted primarily into Ether and warned that further laundering could involve decentralised financial platforms and rapid cryptocurrency-swapping services.
The FBI urged digital-asset exchanges and service providers to block transactions associated with identified attacker-controlled wallets.
North Korea has consistently denied allegations of state-sponsored cryptocurrency theft. US President Donald Trump also said on October 31 that Washington was not yet certain of Pyongyang’s involvement, despite the FBI’s formal attribution.
TRM Labs estimates that North Korea-linked hackers have stolen approximately $12.8 billion in cryptocurrency since 2017, including $7.4 billion during 2026 through October.
Binance replaces $6bn as withdrawals restart
By November 1, Binance said it had replenished approximately 95% of the affected assets, equivalent to about $6 billion, after setting aside roughly $6.34 billion of company resources to cover the losses.
The replacement funding draws on the exchange’s corporate treasury, its Secure Asset Fund for Users (SAFU) and part of its Futures Insurance Fund.
Co-chief executive Yi He said Binance would use approximately half its SAFU reserve and subsequently restore the fund to around $1 billion.
Withdrawals began returning in phases on Sunday, initially including Bitcoin, Ethereum, BNB, XRP and selected stablecoins. Other assets and networks are being restored following additional security checks.
The remaining 5% consists primarily of less-liquid tokens that Binance says require additional market purchases.
The exchange maintains that customers will not bear the financial losses. Importantly, however, the replenishment of customer assets with company funds is separate from the recovery of stolen cryptocurrency.
Binance has also published an updated proof-of-reserves snapshot dated October 31, with full cryptographic verification expected by November 3. While this should allow customers to verify reserve backing for specified assets, it does not constitute a comprehensive independent audit of the exchange’s overall financial position.
Financial impact and remaining risks
The attack briefly unsettled cryptocurrency markets, with Bitcoin and Ether prices declining on Friday as investors assessed the loss and the suspension of withdrawals.
Its significance extends beyond immediate price movements.
Binance reported approximately 335 million registered users worldwide and $162.8 billion in assets under custody in its 2025 annual report, illustrating the scale of customer exposure to the exchange’s operational systems.
The company has absorbed an exceptional financial burden, drawing on emergency reserves and corporate resources while simultaneously attempting to restore confidence and maintain customer liquidity.
Three major uncertainties remain: how much of the stolen cryptocurrency can ultimately be recovered; whether investigators have identified and eliminated every point of compromise; and how the exchange will replenish its protective reserves while demonstrating the continuing adequacy of customer asset backing.
The incident may also intensify regulatory scrutiny of cryptocurrency custody, transaction-authorisation controls, independent reserve verification and the financial resources exchanges must maintain against exceptional operational losses.
Binance’s ability to replace nearly $6 billion of stolen assets has helped prevent an immediate transfer of losses to customers and allowed withdrawals to resume. But the restoration of account balances does not resolve the underlying security failure.
The next test will be the exchange’s full forensic report, independent verification of its reserves and the international effort to recover funds still controlled by the attackers.
For the wider cryptocurrency industry, the incident exposes a fundamental distinction: blockchain networks may remain technically secure while the institutions entrusted with controlling access to billions of dollars in digital assets remain vulnerable. Preventing the next record theft will require stronger transaction controls, independently tested security systems and enforceable financial safeguards — not merely larger reserves to absorb the losses afterward.
Related Articles:
Bitcoin Slides as Iran War Triggers Global Crypto Liquidations
Taiwan’s AI Cyberattack Offers a Warning for Global Banks
Read Also:
Africa’s Cybercrime Losses Rise 152% as AI Expands Criminal Reach
MCIT Advances Digital Sovereignty Strategy as Egypt Strengthens Cybersecurity Ambitions
