Ahmed Kamel – Egypt Daily News
Binance, the world’s largest cryptocurrency exchange, is confronting the fallout from a security breach in which approximately $6.36 billion in digital assets were transferred from wallets across 10 blockchain networks. Blockchain intelligence firms say the scale of the theft would make it the largest recorded crypto heist. They have linked the operation with high confidence to a North Korean hacking group, though Binance says it is still working with law-enforcement partners to establish who was responsible.
The attack took place on October 29, with most of the money moved in roughly 20 minutes, according to TRM Labs. Its analysis traces the stolen assets from Binance-associated wallets to addresses controlled by the attackers. The affected networks included Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.
TRM attributed the incident to TraderTraitor, a hacking unit it describes as North Korea-linked. Chainalysis also assessed that the group was likely responsible. The firms cited similarities with previous attacks attributed to North Korean hackers, including the 2025 theft from cryptocurrency exchange Bybit. Those assessments are not the same as a public confirmation by authorities: Binance said it was cooperating with law enforcement to identify the criminals, and North Korea had not publicly responded to requests for comment.
Binance said it had worked with blockchain partners to freeze about $3 billion in assets connected to the incident. Separate reports from companies involved in the response put the frozen amount at roughly $2.7 billion, illustrating that estimates may vary as firms track assets across different networks and update their figures. The status of the remaining stolen funds has not been fully clarified. TRM’s analysis said the attacker still controlled substantial amounts of cryptocurrency after the freezes.
The exchange suspended withdrawals on affected networks but said deposits were not impacted. It expected withdrawal services to resume within about 45 hours to two days, depending on the update. Binance also said it would cover losses, while the company’s co-CEO, Richard Teng, stated that customer funds were safe and that the company would bear the costs. Binance has a secure asset fund intended to protect users in cases of security breaches.
The attack’s entry point remains under investigation. Binance initially said investigators were examining whether a compromised laptop belonging to an engineer had enabled access to its systems and unauthorized withdrawals. The company later said it had identified additional points of breach. It has not released a complete technical account of how the theft was carried out, and said more information would follow when the investigation is finished.
The scale and speed of the transfers rattled financial markets. Bitcoin fell more than 3% and reached a six-week low of $76,368. Ether also declined by more than 3%, touching a two-month low of $2,178. Binance’s BNB token dropped about 5%. The selling pressure extended to publicly traded companies: Coinbase shares fell 4.8%, while shares in Strategy, a major corporate holder of bitcoin, lost nearly 6% in extended trading.
Several companies moved to block assets they believed were connected to the theft. Stablecoin issuers Tether and Circle froze funds, while Ripple also reported freezing assets. World Liberty Financial said it worked with a custodian to freeze funds as well. Such interventions can limit the attackers’ ability to move or convert certain tokens, but they do not establish that all the stolen assets can be recovered.
The breach has renewed questions about security controls at major exchanges and the risks of holding assets on platforms connected to internet-accessible wallets. Cybersecurity specialists have questioned whether stronger approval procedures could have prevented unauthorized transactions. Binance, however, said it had found no evidence that private keys to its wallets had been leaked, and has not yet released a complete technical explanation.
The case also adds to concerns about the broader cryptocurrency sector, which has faced a series of high-value thefts. Last year, researchers recorded nearly 150 attacks that resulted in about $2.9 billion in stolen cryptocurrency. A separate $1.5 billion theft from Bybit in February 2025 was among the incidents attributed by U.S. authorities to North Korea-linked operators.
For investors, the eventual impact will depend not only on how much of the money is recovered but also on whether the incident disrupts services or weakens confidence in digital-asset platforms. Binance’s assurances and the rapid freezing of some funds may help limit the immediate damage. But with billions of dollars still unaccounted for and the investigation ongoing, the breach is likely to intensify scrutiny of how exchanges secure customer assets and respond to attacks.
