$6.3 billion stolen in biggest cryptocurrency heist in history

Imagine checking your cryptocurrency account and discovering that the exchange holding your money has been hit by a theft worth billions. That is the situation facing Binance, the world’s largest cryptocurrency exchange by trading volume, after hackers stole an estimated $6.3 billion in a cyberattack that has sent shockwaves through the cryptocurrency industry. The attack took place on Thursday, October 29, targeting the systems Binance uses to authorise and process transactions.

The theft is being described as the largest cryptocurrency heist in history, with blockchain analysts reporting that much of the money was transferred within approximately 20 minutes. Binance has pledged to cover the full financial loss, but the scale of the breach has raised serious questions about how an exchange handling billions of dollars in digital assets could have its security systems compromised. 

Hackers exploited Binance’s transaction systems

Binance’s initial investigation suggested that the attack may have started with a compromised laptop belonging to a DevOps engineer. The hackers are believed to have used access gained through the device to enter a service container and submit withdrawal transactions without proper authorisation. The company later discovered additional points of compromise and said the incident was more complex than first understood. It has not yet published a complete technical explanation of how the attackers managed to move such a large amount of cryptocurrency.

Investigators believe the attackers gained control of part of the infrastructure responsible for approving transactions. This allowed them to authorise transfers to wallets under their control. Binance has said there is currently no evidence that private keys belonging to its wallets were leaked. It has revoked the affected authorisations and is examining the systems involved in the breach. 

Binance promises to replace the stolen money

The exchange has said it will absorb the entire financial impact rather than pass the losses on to users. It is using its Secure Asset Fund for Users (SAFU), an emergency reserve established to protect customers in the event of serious security incidents, alongside its corporate funds. In its October 30 update, Binance said it had allocated more than $6.34 billion to cover the loss. Around $5 billion was held in the same types of cryptocurrency that had been stolen, with the remaining amount being purchased through market and over-the-counter transactions.

The company said it had already covered approximately 80 per cent of the affected amount. That commitment is significant given the size of the theft. The amount involved is far beyond the losses suffered in many previous cryptocurrency exchange attacks, and replacing it requires Binance to put substantial company resources behind its promise. 

Billions frozen as investigators trace the money

Recovering the stolen cryptocurrency is another matter. Once digital assets have been transferred between wallets, tracing their movements can be difficult, particularly when criminals use multiple addresses and services in an attempt to conceal where the funds have gone. Binance reported that approximately $3 billion in affected assets had been frozen through cooperation with its partners. The company is also working with law enforcement agencies, blockchain intelligence firms and cryptocurrency issuers to identify and restrict further transfers.

Tether and Circle are among the companies reported to have frozen assets connected to the incident. Their involvement is important because issuers of certain digital currencies can sometimes freeze tokens held at identified wallet addresses. However, freezing assets does not mean that all the stolen money has been recovered. The whereabouts of the remaining funds are still being investigated, and the final amount that can be retrieved remains uncertain. 

North Korean hackers suspected

Attention has also turned to the possible identity of those behind the attack. Blockchain analysis firms have identified similarities between the Binance incident and previous cryptocurrency thefts linked to North Korean hacking groups. Researchers at TRM Labs and other firms have pointed to techniques resembling those used in earlier attacks, including the major theft from cryptocurrency exchange Bybit in 2025.

North Korean-linked groups have been accused of stealing digital currencies to generate funds for the country. However, no official investigation has publicly confirmed that North Korea was responsible for the Binance breach, and the suspected connection remains under examination. 

Withdrawals suspended while security checks continue

Binance temporarily suspended deposits and withdrawals while it investigated the breach and secured the affected systems. The exchange subsequently said that deposits and services not affected by the attack remained operational, although withdrawals were still subject to security checks before normal access could resume. The company has been working to strengthen its transaction approval systems and verify that the breach has been contained. It has also promised to release a more detailed technical account once its investigation is complete. 

The attack has also affected confidence across the cryptocurrency market. Bitcoin and Ether came under pressure following reports of the theft, while shares in some companies connected to the digital currency industry also fell. Binance now faces questions over how hackers managed to breach its transaction systems and whether its security measures are strong enough to prevent another attack Even if the company makes good on every dollar, the breach has exposed how vulnerable an exchange can be when attackers find a way into the machinery used to approve transactions. And with $6.3 billion involved, the questions about how it happened are unlikely to disappear when the money is replaced.