Photo: Costfoto / Reuters
News of the attack emerged when specialists analysing cryptocurrency transactions detected a series of large transfers from Binance’s hot wallets, according to DW. Such wallets are used by the exchange to carry out client transactions.
According to the analytics firm TRM Labs, the attackers withdrew around $6.36 billion from Binance’s wallets across ten blockchain networks. The bulk of the funds was transferred in around 20 minutes. Among the stolen assets were around 167,000 Ethereum (ETH) tokens and more than $1.6 billion in Tether (USDT) stablecoins.
Binance initially reported that it was investigating a possible security incident, before confirming the hack. The exchange suspended withdrawals on the affected networks and involved law enforcement agencies in the investigation.
Initially, the company believed that the attackers had gained access to its systems via one of its engineers’ laptops. It later emerged that the attack was more sophisticated: the hackers used access to the exchange’s internal infrastructure to initiate unauthorised transfers. Binance stated that it has not yet detected any signs of a leak of private wallet keys.
The exchange estimates the losses at around $6.3 billion. Binance has promised to fully compensate for the losses using its own funds and the SAFU user protection reserve fund. According to the latest Reuters report dated 31 October, the company stated that it had already recovered 90 per cent of the stolen assets. It has set aside approximately $6.34 billion to cover the losses.
In addition, it has managed to freeze assets worth approximately $3 billion. A significant portion of these funds has been blocked by the stablecoin issuers Tether and Circle.
Who might be behind the attack on Binance
Analysts from several companies specialising in investigating cryptocurrency crimes have linked the attack to North Korea. In particular, researchers at TRM Labs attribute it with a high degree of certainty to the TraderTraitor group, which is also linked to North Korean state agencies.
This group is known by other names — the Lazarus Group and APT38. It is suspected of numerous attacks on financial institutions and cryptocurrency platforms. In February 2025, it was linked to the hack of the Bybit exchange, in which approximately $1.5 billion was stolen. The current attack on Binance has far exceeded that incident in scale.
However, Binance itself has not yet named the alleged perpetrators. The investigation is ongoing.
Bitcoin fell in price, but the market avoided a crash
News of the theft caused concern in the cryptocurrency market. On 30 October, Bitcoin fell by more than 3 per cent, dropping below $79,000. However, there was no major crash.
The attack on Binance became the largest known cryptocurrency theft in the industry’s history. By way of comparison, the losses from the Bybit hack in February 2025 were estimated at approximately $1.5 billion.
This story was translated with the assistance of artificial intelligence.The translation was also reviewed by the Logos Press editorial team.
Follow our updates
Have information for the newsroom? Share it with Logos-Press
Comments
0No comments yet. You can start the conversation.
Comments are open to readers with a Logos Press account.
Sign in to comment