The world’s largest cryptocurrency exchange, Binance, recently suffered a significant security breach, with losses amounting to about $6.3 billion. According to blockchain intelligence firms, the attack is believed to have been executed by North Korean state-sponsored hackers.
Details of the Binance Security Breach
TRM Labs, which meticulously tracked the on-chain transactions, reported that the massive fund siphoning affected Binance wallets across ten blockchains on October 29. The attack was swift, with most of the assets being moved in a mere 20 minutes.
This incident surpasses the previous record held by a $1.5 billion theft from Bybit in February 2025. In response, Binance has paused withdrawals and assured users of compensation through company funds and the Secure Asset Fund for Users (SAFU).
Investigation and Technical Analysis
Initial investigations by Binance suggest that the breach might have originated from a compromised employee’s laptop. Specifically, an attacker potentially exploited a DevOps engineer’s laptop to access a service container and execute unauthorized withdrawal requests. Fortunately, there is no evidence indicating a breach of wallet private keys at this time.
TRM’s findings indicate the attackers prepared meticulously, spending over a day readying for the breach. The operation’s wallet was funded via small Tornado Cash withdrawals, and the malicious software was tested on other wallets before the full-scale attack.
North Korean Links and Global Implications
TRM Labs attributes the attack to North Korea’s TraderTraitor, a notorious hacking unit, based on substantial on-chain and off-chain intelligence. Similarities with previous cyber-attacks, such as the Bybit and KelpDAO incidents, further support this attribution.
Notably, the hackers deviated from typical laundering tactics by engaging in large trades with market makers and utilizing lending platforms instead of cross-chain bridges. As a precaution, stablecoin issuers froze approximately $2.7 billion in assets, but attackers still control significant amounts of unfrozen digital assets.
This breach underscores the persistent threat of state-sponsored cyber activities targeting the cryptocurrency sector. Binance continues to collaborate with law enforcement to bring the perpetrators to justice, while the global crypto community remains vigilant against further threats.
