Binance Security Breach: $6.3 Billion Crypto Heist Impact
Binance, the world's largest crypto exchange, lost roughly $6.3 billion in a 20-minute security breach that halted withdrawals. The exchange says it will cover all losses, and blockchain analysts link the theft to North Korea.
Newsnibs Staff
- 2026-10-31
- Updated 2:41 AM UTC
Binance, the world's largest cryptocurrency exchange, announced a security breach on Thursday in which roughly $6.3 billion was taken, a loss that Reuters reports could be the largest crypto theft on record. The company halted withdrawals, said customer funds are safe, and expects to resume withdrawals within 48 hours. Binance co-founder Yi He said the exchange will cover "all hacking losses."
The theft took about 20 minutes and began shortly after 8pm GMT. Binance has set aside more than $6.34 billion of company funds to cover the losses, and Larry Cooke, director of Binance Africa, said about $5 billion of that is already held in the same token assets that were affected. Co-CEO Richard Teng said the losses would be met from Binance's $1 billion Secure Asset Fund for Users plus company resources. The exchange had 335 million registered users and held about $162.8 billion in customer assets as of its 2025 annual report.
Binance says it has located about $3 billion of the stolen assets, with about $3.3 billion still unaccounted for. Roughly half of the total is stablecoins such as USDT and USDC, which their issuers can freeze. Tether froze about $1.57 billion and Circle more than $800 million. Ripple and World Liberty Financial, which is linked to US President Donald Trump and his family, also froze funds linked to the incident. World Liberty said it is working with the custodian BitGo on the effort.
Bitcoin and ether are harder to recover. CNA estimates about $2.4 billion in the two coins is out of immediate reach because they cannot be frozen remotely. According to one account, the attackers deposited stolen USDT into the lending platform Aave as collateral and borrowed ETH against it.
Binance's initial investigation traced the breach to a hacked laptop belonging to one of its engineers, though later work found more points of entry. One account describes that engineer as working in DevOps, with a laptop infected by malware, and says the attackers never obtained master private keys. It says they instead used the EIP-7702 smart-contract feature to turn Binance hot wallets into automated "sweeper" contracts across 10 blockchains. Lawyer Joshua Chu said blockchain records show the attackers compromised Binance's signing infrastructure to authorize transactions, rather than stealing a physical vault key. Hendrik de Bruin of Check Point Software Technologies said the attack did not break encryption. It subverted the process that tells keys what to sign.
TRM Labs and Chainalysis, both US firms, and the British firm Elliptic have expressed high confidence that North Korea was responsible. TRM Labs pointed to similarities with earlier operations attributed to the same group, including the Bybit attack the previous year, and with ZachXBT attributed the breach to a state-sponsored North Korean group called TraderTraitor. North Korea has not commented. Teng said the investigation has not yet blamed any individual.
Bitcoin fell more than 3% on Friday to a six-week low of $76,368, and ether dropped more than 3% to a two-month low of $2,178. Analysts say the breach could reduce risk appetite and push investors to reassess the safety of assets held on centralized exchanges. Allan Juma of ESET noted that the hack coincided with the global disclosure of the PHP2Shell vulnerability. Bernardo Brites, CEO of Trace Finance, said AI-driven exploitation of vulnerabilities is making hacks harder to counter.
The breach follows a $388 million theft from the exchange Bitget on September 24.
Photo by Kanchanara on Unsplash
