Inside the Binance Breach

• Binance estimates roughly $6.3 billion in digital assets were affected in what appears to be the largest cryptocurrency theft ever recorded.
• Investigators traced the attack across ten blockchains, while issuers and blockchain operators froze roughly $3 billion before it could be moved.
• Blockchain intelligence firm TRM Labs attributes the operation with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit previously linked to the $1.5 billion Bybit theft.

By Samuel López | USA Herald

Binance is dealing with what appears to be the largest cryptocurrency hack in history after approximately $6.3 billion in digital assets were moved from wallets connected to the world's largest crypto exchange.

What began Thursday as reports of a possible security incident quickly became something much larger.

Binance now says its initial investigation indicates that a DevOps engineer's laptop may have been compromised, allowing an attacker to gain access to a service container and submit unauthorized withdrawal transactions. The exchange said it has found no evidence that wallet private keys themselves were leaked.

Blockchain intelligence firm TRM Labs calculated the total movement at approximately $6.36 billion across ten blockchains, including Ethereum, Bitcoin, Tron, XRP Ledger and Solana. According to TRM, most of the money moved during an extraordinarily fast burst beginning around 20:05 UTC on Oct. 29.

That number matters.

The February 2025 Bybit theft attributed by U.S. authorities to North Korean hackers totaled approximately $1.5 billion. If TRM's Binance tracing holds, this attack was more than four times larger.

TRM says it has attributed the operation with high confidence to TraderTraitor, an elite North Korean hacking unit previously associated with major cryptocurrency thefts. Binance itself has not publicly identified the attackers and says it is working with law enforcement to determine who was responsible.

The technical details are particularly troubling.

TRM found that Binance wallets on multiple unrelated blockchain networks produced valid transactions benefiting the attacker within a short period. On Ethereum, researchers say the attacker used EIP-7702 functionality and a batch of pre-signed authorizations to turn a Binance hot wallet into what amounted to an automated sweeper.

But Ethereum was only part of the attack.

Bitcoin, XRP, Tron, Solana and other Binance-linked wallets also transferred assets using valid signatures. TRM therefore believes the evidence points beyond the compromise of one individual wallet and toward Binance's broader hot-wallet signing infrastructure. Binance has not yet published its final root-cause analysis.

The industry's response was unusually fast.

Tether, Circle, Ripple, World Liberty Financial and blockchain operators moved to freeze billions of dollars in affected assets. Binance says approximately $3 billion has now been frozen on-chain. TRM independently calculated roughly $2.7 billion frozen during the first hours of the incident.

That ability to freeze stablecoins may become one of the most consequential parts of this story. Crypto is often described as money that cannot be stopped once transferred. This attack demonstrated something more complicated: Bitcoin and Ether can be difficult to seize, but centrally issued stablecoins such as USDT and USDC can be frozen by their issuers before an attacker successfully converts or launders them.

Binance temporarily suspended deposits and withdrawals while carrying out security checks. The company says customer funds are safe and that losses will be covered through its Secure Asset Fund for Users, known as SAFU, together with company funds. It also says it will release an updated Proof of Reserves after remediation is completed.

The next Proof of Reserves deserves close attention.

This was not simply another phishing theft against an individual investor. Billions moved from infrastructure belonging to the largest cryptocurrency exchange on Earth, across multiple networks, in minutes.

And despite approximately $3 billion being frozen, TRM estimates that the attacker still controlled more than 420,000 ETH and 18,270 Bitcoin worth roughly $2.4 billion beyond stablecoin issuers' immediate reach during its initial analysis.

For investigators, exchanges and governments, the theft has now become both a cybersecurity case and a race to follow the money before those assets are broken apart, swapped across networks or moved through services designed to make tracing considerably harder.

About the Author

Samuel López is a USA Herald reporter and news correspondent whose work focuses on legal affairs, insurance, emerging technology and complex investigations. Drawing on more than two decades of experience working with legal matters and analyzing state and federal litigation, López examines major cybersecurity and financial events not only as breaking news, but through the questions of liability, evidence, risk and accountability that follow when billions of dollars are placed in jeopardy.

Stay Ahead of the Next Major Story

The biggest stories rarely end with the first headline. Get USA Herald's investigative reporting, breaking legal coverage, national-security analysis and deeper reporting delivered directly to you. Subscribe to the USA Herald exclusive newsletter.

Follow USA Herald on X at @RealUSAHerald.