Binance Cyberattack: What We Know About the $6.3 Billion Theft
Binance has estimated the total impact of a cyberattack at about $6.3 billion. The company says roughly $3 billion of the affected assets have been frozen on the blockchain so far, according to Engadget.
Reuters describes Binance as the world's largest cryptocurrency exchange, a company where people buy, sell and hold digital coins.
Binance says it will cover all losses using money from its SAFU fund, a reserve set aside to protect users, along with funds from the company itself. It also says user funds are safe.
Withdrawals are frozen while Binance carries out a security overhaul. Deposits have continued as normal. Reuters reported on October 29 that Binance expects to resume withdrawals within the next 48 hours, following the October 2026 security incident, in a Reuters report.
The freezes did not stop at Binance. Tether froze $1.5 billion in funds linked to the attack, and Circle froze $800 million. Both companies issue stablecoins, a type of crypto designed to stay close to the value of a currency such as the US dollar. Together, the two freezes account for most of the funds that have been locked on the blockchain so far.
Binance's early investigation points to a weakness in its daily operations, not in the blockchain software itself. A compromised laptop belonging to a DevOps engineer, the staff member who builds and runs the company's software, may have let the attacker reach a service container. From there, the attacker may have submitted withdrawals that were never authorized.
The investigation is at an early stage, and Binance has not yet published a full root-cause analysis, meaning a complete account of what went wrong. How the attacker moved from the laptop into the container, and what safeguards stood between that container and the withdrawal system, is still unclear.
Security research firm TRM Labs has attributed the attack to TraderTraitor, which it describes as North Korea's elite hacking unit, with high confidence. That attribution comes from TRM Labs, not from Binance.
If the $6.3 billion estimate holds, this would be the largest cryptocurrency theft on record, surpassing the $1.5 billion hack of the Bybit exchange last year. That comparison depends entirely on the current estimate, which Binance has described as an estimate.
The broader context here is that attackers increasingly target more than an exchange's public website. They look at engineering tools, the systems that deploy software, and the passwords and keys that reach the systems moving money. Think of it like a building where a visitor badge also opens the vault. A single compromised work computer with high-level access can, under the path described, produce transactions that look approved to the systems that process them.
Security experts often recommend several defenses. Hardware-bound credentials tie a login to a physical device. Segregated signing environments keep the keys for moving money apart from everyday work. Withdrawal rules can require a second, independent approval. Whether Binance uses these in its rebuilt systems is what the return of withdrawals will test.
In my view, the stablecoin freezes matter more for the wider market. Two companies halted $2.3 billion in flows tied to one incident within days. That gives the industry a clear measure of how much control centralized issuers hold. That control can protect users, but it also places a discretionary decision point in the path of recovery. How exchanges and issuers coordinate next time will depend on how that tradeoff is handled.
For companies that run exchanges, the practical lesson is narrower. Engineers' laptops are core company assets. The more useful question is not only whether a determined state actor can reach an engineer's laptop, but whether a compromised laptop can reach a withdrawal path at all.
