Binance said on Friday that its investigation had uncovered further points of breach beyond the compromised engineer’s laptop first identified in its account of the theft. The exchange is trying to trace and freeze funds after putting the total impact of the hack at about $6.3 billion.
The attack began at 8:05pm on 29 October, when attackers moved approximately $6.36 billion in cryptocurrency out of Binance wallets across 10 blockchains. The operation was coordinated and completed in about 20 minutes.
Binance’s initial investigation found that an attacker had used a compromised DevOps engineer’s laptop to reach a service container and submit withdrawals that had never been approved.
Alan Woodward of the University of Surrey said: 'It shouldn't be possible for a single [developer] PC to be compromised and somehow for that to allow the entire exchange to be compromised'.
Binance said its review had found nothing to indicate that private keys for wallets had been leaked. It later said its investigators had found more systems through which the exchange had been breached.
The exchange halted all deposits and withdrawals on Thursday while it reviewed its security. It said it expected withdrawals to resume within 45-48 hours, and that it was working with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover more assets.
Blockchain partners have frozen about $3 billion on-chain, Binance said. Tether locked up over $1.567 billion in its stablecoin, while Circle froze upward of $800 million worth of USD Coin connected to the heist.
Elliptic analysts said the attacker had converted about $3.3 billion into digital assets that could not be frozen and was working to exchange them for traditional currency.
TRM Labs and Pangolin Intelligence said the operation bore the hallmarks of North Korea’s TraderTraitor hacking group. Elliptic also attributed the breach to the group. Nick Carlsen, a senior investigator at TRM Labs, told The Wall Street Journal: 'This was absolutely North Korea'.
TRM Labs said preparations for the attack may have begun several days earlier. TraderTraitor was also behind a $1.5 billion hack of the Bybit crypto exchange in February 2025.
The US Department of the Treasury sanctioned the Lazarus Group in 2019, saying it was controlled by North Korea’s primary intelligence bureau. The FBI blamed the 2025 Bybit hack on the same unit.
The Treasury has previously said that stolen money from such attacks is used to finance North Korea’s nuclear missile programme.
Binance said it would absorb every loss through its Secure Asset Fund for Users, or SAFU, and its corporate funds. The stolen amount is more than six times the $1bn emergency fund, which was set up in 2018.
The company has set aside more than $6.34 billion to cover the losses, including $5 billion held in the exact token assets required and in Binance custody.
Shares in the crypto exchange Coinbase fell 4.8 percent.
Comments (0)