Cryptocurrency exchange Binance has confirmed that a complex cyberattack affected an estimated $6.3 billion in assets, with about $3 billion frozen following investigations conducted in collaboration with law enforcement agencies and blockchain intelligence firms.
The company disclosed the estimated impact on Friday, October 30, 2026, saying the figure could increase as investigators continue efforts to trace and freeze additional assets.
Binance, the world’s largest cryptocurrency exchange by daily trading volume, said its investigation had uncovered additional points of breach, contradicting its initial assessment that the attack originated from a compromised laptop belonging to a DevOps engineer.
“This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” the company said in a statement posted on X.
The exchange had earlier assured customers that their funds remained safe while also promising to cover all losses arising from the incident.
The estimated $6.3 billion impact would make the incident significantly larger than the $1.5 billion cryptocurrency theft from Bybit in February 2025, previously regarded as the biggest cyberattack against a crypto platform.
Binance Investigates Multiple Security Breaches
Binance initially said the attackers gained access through a compromised laptop belonging to a DevOps engineer, enabling an unauthorised party to access a service container and execute withdrawal transactions.
However, subsequent investigations revealed additional points of breach, prompting the company to revise its initial assessment.
The exchange said it had found no evidence that private keys from its wallets were leaked and promised to publish a detailed technical analysis after investigations are completed.
Binance also announced that deposits remained unaffected, while withdrawals and deposits had initially been temporarily suspended. As of 0900 GMT on Friday, the company said it was on track to resume withdrawals within 45 hours.
Tether, Circle Freeze Affected Assets
The incident has triggered coordinated action from major stablecoin issuers to limit the movement of potentially stolen funds.
Paolo Ardoino, chief executive of Tether, said the company had frozen approximately $1.6 billion connected to the potential Binance exchange hack.
Jeremy Allaire, chief executive of Circle, also disclosed that his company had frozen more than $800 million in USDC.
USDT and USDC are stablecoins whose values are pegged to the US dollar and are widely used for cryptocurrency trading and transfers.
Binance said approximately $3 billion in affected assets had been frozen, although investigations remain ongoing.
North Korean Hackers Suspected
Blockchain intelligence firm TRM Labs said it had high confidence that the attack was orchestrated by TraderTraitor, a hacking group affiliated with North Korea.
The firm cited intelligence gathered from both on-chain and off-chain investigations, noting similarities between the Binance incident and previous cyberattacks linked to North Korean hackers.
TraderTraitor is believed to be associated with the Lazarus Group, which has been linked to several high-profile cyberattacks, including the 2014 hacking of Sony Pictures Entertainment.
The group was also linked to the February 2025 Bybit theft, in which approximately $1.5 billion was stolen.
The US Department of Justice and the Federal Bureau of Investigation had not immediately commented on the latest incident as of Friday.
