The largest cryptocurrency exchange Binance has faced a large-scale hacker attack. According to the company's preliminary assessment, the incident affected assets worth about $6.3 billion (around 2.86 trillion tenge). The attackers managed to withdraw most of the funds in approximately 20 minutes.
HOW THE HACK HAPPENED
As reported by the company, a preliminary investigation points to a possible compromise of a DevOps engineer's laptop. Through it, the attacker could have gained access to a service container and sent unauthorised withdrawal transactions.
At the same time, Binance stated that it had not found signs of leakage of private keys of cryptocurrency wallets. The company promised to publish a detailed technical report after completing the investigation and verifying all circumstances.
According to TRM Labs analysis, the main transfers began on 30 October at 01:05 Kazakhstan time. Most of the assets left the exchange's wallets in approximately 20 minutes.
The attack affected ten blockchain networks, including Bitcoin, Ethereum, Tron and Solana. According to analysts, the attackers used various methods of transferring and exchanging cryptocurrency to withdraw funds from the exchange's wallets.
HOW MUCH MONEY WAS RECOVERED
After detecting the attack, Binance began blocking suspicious transactions in collaboration with other cryptocurrency companies.
According to the exchange's statement, it managed to freeze about $3 billion. According to more precise estimates by TRM Labs, by 30 October the blocked amount was approximately $2.7 billion.
In particular, the company Tether froze about $1.77 billion in USDT, and Circle — approximately $825 million in USDC. These companies issue popular digital currencies that can be blocked under certain conditions.
However, the attackers managed to exchange part of the money for other cryptocurrencies. According to analysts' estimates, assets worth approximately $2.4 billion remained under their control.
WHO COULD BE BEHIND THE ATTACK
TRM Labs analysts link the incident to the TraderTraitor group, which is attributed to North Korean hackers.
Specialists found similarities between this attack and previous major hacks of cryptocurrency platforms. In particular, they pointed to similarities in methods with the attack on the Bybit exchange in February 2025, when attackers withdrew about $1.5 billion.
At the same time, Binance has not yet confirmed the involvement of a specific group. The company said it is cooperating with law enforcement agencies to identify those responsible.
WHAT WILL HAPPEN TO USERS' MONEY
Binance stated that client funds are safe. The company also promised to cover possible losses itself, using its own funds and a special reserve fund SAFU, designed to protect users.
After detecting the problem, the exchange temporarily restricted certain operations, checked the security of its systems and began interacting with companies that help track the movement of cryptocurrency.
This incident could become the largest cryptocurrency theft in history.
