Binance is drawing on company reserves to cover a $6.3 billion cryptocurrency theft after hackers drained its digital wallets, forcing the world’s largest crypto exchange to suspend deposits and withdrawals.
The company said Oct. 30 that it had reserved more than $6.34 billion to cover losses, including $5 billion already held in the affected token assets, adding that industry partners helped freeze approximately $3 billion in assets swept up in the attack.
An initial investigation suggested a compromised DevOps engineer’s laptop allowed an attacker to access a service container and submit unauthorized withdrawals, according to Binance’s security statement. The company said it had found no evidence that wallet private keys were leaked.
Blockchain intelligence firm TRM Labs attributed the theft to North Korea’s TraderTraitor hacking group. It estimated that approximately $6.36 billion left Binance wallets across 10 blockchains on Oct. 29, most within about 20 minutes, making it the largest cryptocurrency theft on record.
“We make this judgment with high confidence,” TRM said of its attribution, citing intelligence gathered on and off the blockchain. Binance’s initial statement did not identify the attackers and said it was working with law enforcement to establish their identities.
The exchange said it had revoked the affected address’s authorization and would publish a technical postmortem after verifying its findings, pledging updated proof-of-reserves reporting following remediation.
Rafe Pilling, senior director of threat research at Sophos, noted TraderTraitor are experts at mapping out the technical and business processes necessary to make authorized transfers and develop a custom attack tailored to the victim.
“This group are somewhat artists in terms of getting into these distributed finance companies,” he said. “In the past, they’ve developed their own fake applications and tried to use those to get inside organizations.”
Developer access becomes a route to withdrawals
Binance’s preliminary account leaves open how the engineer’s laptop was compromised and how access to a service container enabled unauthorized transactions.
“Once attackers are on a developer’s machine, they’re inside your development environment with that developer’s access,” said Patrick Münch, CISO at security firm Mondoo.
Münch explained that software supply chain attacks can begin with people rather than compromised packages. Attackers may impersonate recruiters or prospective contributors or send developers coding tests containing malware.
Pilling explained that TraderTraitor’s attacks typically begin by compromising a software developer or engineers’ workstation, using that access to conduct reconnaissance and develop the technical attack.
“In a relatively short space of time they launch the attack using rapid, coordinated transactions to steal cryptocurrency from the victim organization,” he said.
Binance has not disclosed whether any of those methods played a role in this incident.
The access control issue hit headlines earlier this year, when cybersecurity firm CrowdSec disclosed that a departing engineer's GitHub access, granted a short extension to finish outstanding work, had been exploited after his personal laptop was compromised by malware hidden in NPM packages.
The attacker used the lingering credentials to download private CrowdSec repositories, and the breach went undetected for nearly four months until the stolen code surfaced publicly.
Münch said he recommended keeping long-lived production credentials off individual laptops and using short-lived tokens to reduce the window in which stolen access remains useful.
Transaction speed limits time to intervene
The rapid movement of funds raises questions about controls that limit losses after an attacker gains access to financial systems.
“Attackers are no longer focused solely on breaking into systems or stealing customer data,” said Phoebe Hodgson, senior banking and payments analyst at GlobalData. “They are increasingly seeking to exploit the trust embedded within financial infrastructure, turning legitimate access and transaction processes into mechanisms for moving money.”
Hodgson cautioned that increasingly interconnected systems and automated processes leave institutions little time to intervene once attackers find a trusted route into transaction processing.
She explained that while preventing intrusion remains necessary, institutions must also design operations to contain the consequences of a compromise.
“Banks must assume that some defenses will eventually fail and design their operations to prevent a single compromise from becoming a financial catastrophe,” Hodgson said.
Timeline: World’s biggest crypto hacks
The past decade has seen a dramatic escalation in cryptocurrency threats, evolving from early code exploits and exchange insolvencies to state-sponsored, multi-billion-dollar cyberheists.
February 2014: Mt. Gox. The world’s largest Bitcoin exchange collapsed after ~850,000 BTC (worth around $450 million at the time) vanished over several years of undetected theft, triggering the exchange’s bankruptcy.
June 2016: The DAO. An attacker exploited a smart contract vulnerability in Ethereum’s DAO fund to drain roughly $60 million in ETH, prompting a controversial hard fork that split Ethereum from Ethereum Classic.
January 2018: Coincheck. Hackers stole around $530 million in NEM tokens from the Japanese exchange after compromising a hot wallet in what became the largest crypto exchange hack on record.
August 2021: Poly Network. A protocol flaw let an attacker siphon roughly $610 million across multiple blockchains, most of which was returned after the hacker was publicly identified.
March 2022: Ronin Network (Axie Infinity). North Korea’s Lazarus Group compromised validator nodes on the Ronin bridge to steal about $625 million in crypto, one of the largest attacks attributed to a state actor.
November 2022: FTX collapse. Not a hack but a historic fraud: FTX’s implosion exposed roughly $8 billion in missing customer funds, reshaping industry trust and regulatory scrutiny.
February 2025: Bybit. Hackers linked to North Korea exploited a multisig wallet transfer to steal approximately $1.5 billion in Ether.
October 2026: Binance. An attacker, attributed to North Korea, moved roughly $6.36 billion from Binance wallets across 10 blockchains in about 20 minutes after a compromised employee’s laptop granted access to a service container used to approve withdrawals — now the largest crypto hack in history.
