The key facts
- Binance estimated the damage at $6.3 billion, with approximately $3 billion in assets frozen
- The preliminary cause is a compromised DevOps engineer's laptop
- TRM Labs links the attack with high confidence to the North Korean group TraderTraitor
What happened
The world's largest cryptocurrency exchange, Binance, announced on October 30that digital assets worth $6.3 billion were affected by a hack, calling it the largest theft in the history of the cryptocurrency industry. According to BBC News, about half of these funds have been frozen with the help of other platforms, and the exchange promised to 'cover all losses.' The previous record was the Bybit exchange hack in 2025, amounting to $1.5 billion.
How events unfolded
Initially, Binance stated it was investigating a 'potential security issue' and that user funds were safe; co-founder Changpeng Zhao at that time estimated the frozen funds at approximately $3 billion, including about $971 million from Tether and $823 million from Circle (according to Anadolu). Later, the exchange clarified: preliminary investigations indicate a compromised DevOps engineer's laptop, through which the attacker gained access to a service container and initiated unauthorized fund withdrawals. The company found no signs of private wallet key leaks. Deposits and withdrawals were temporarily suspended; later, Binance reported that user deposits were unaffected and promised to resume withdrawals within 48 hours, as well as publish a detailed technical analysis of the incident. Losses are planned to be covered from the SAFU fund and the company's own resources.
Who is behind the attack and what analysts say
Blockchain analytics company TRM Labs linked the attack with 'high confidence' to the North Korean group TraderTraitor, noting similarities to the Bybit incident, for which the US FBI also held North Korean hackers responsible. According to TRM Labs data cited by Spot.uz, the main part of the fund withdrawals occurred between 20:05 and 20:25 London time (1:05–1:25 Tashkent time), wallets on 10 blockchains were involved, and attack preparation began at least 36 hours in advance. TRM Labs Global Policy Head Ari Redbord called the event a 'turning point' for the industry and noted that attackers still hold a huge amount of stolen assets. He explained that returning stablecoins like USDC and USDT is easier—their issuers can freeze assets, whereas recovering Bitcoin or Ethereum requires tracking through exchanges and other services. Binance did not directly answer questions about links to North Korea, stating only that it is working with law enforcement agencies to identify the perpetrators.
Market reaction and data discrepancies
Following reports of the hack, cryptocurrency prices fell: Bitcoin dropped by more than 4% according to BBC, while Spot.uz, citing CoinMarketCap, estimated the decline at 2.3% (to $78,430, with a minimum of $76,400—the lowest since September), and Daryo.uz reported a 3.5% drop. Ethereum fell below $2,200 for the first time since August, and the exchange's own token BNB lost 5%. Note also the discrepancies in early damage estimates: Daryo.uz reported a possible theft ranging from $1.7 to $5.5 billion, while Binance later stated the amount as $6.3 billion, of which about $3 billion is frozen. Besides Tether and Circle, World Liberty Financial—a cryptocurrency company linked to US President Donald Trump's family—also promised to freeze funds. Binance, founded in 2017 in China, reportedly has over 300 million registered users; in 2024, the company claimed to manage over $160 billion in assets.
