Binance, the world’s largest cryptocurrency trade, has stated a safety breach hit $6.3 billion price of crypto belongings, in what blockchain intelligence agency TRM Labs calls the most important crypto theft in historical past.

Belongings started leaving Binance’s wallets at 20:05 UTC on Thursday, 29 October, and many of the cash was gone in roughly 20 minutes, TRM Labs stated in its analysis of the attack, which places the quantity moved at about $6.36 billion throughout 10 blockchains.

Binance confirmed the breach in posts on X, stated “person funds are utterly protected” and that it will “cowl all losses”, and suspended deposits and withdrawals whereas its crew ran safety checks.

“TRM attributes the assault to TraderTraitor, North Korea’s elite hacking unit, primarily based on strong on and off-chain intelligence. We make this judgment with excessive confidence,” the agency stated.

TraderTraitor is the crypto-focused arm of the Lazarus Group, the hacking operation linked to North Korea.

The FBI named the identical group in February 2025 over the theft of “roughly $1.5 billion in digital belongings from cryptocurrency trade, Bybit”.

It is price noting that Binance has not named anybody.

How the cash left in about 20 minutes

Ethereum accounted for the most important share at about $3.79 billion, in keeping with TRM’s rely. Bitcoin outflows got here to 18,270 BTC, about $1.47 billion, with Tron at about $628 million, the XRP Ledger at about $296 million and Solana at about $96 million.

On Ethereum, the attacker used EIP-7702, a characteristic that lets an extraordinary pockets hand management of its transactions to a sensible contract. One transaction carried 50 authorisations signed by a Binance sizzling pockets, a pockets stored on-line so buyer withdrawals could be processed rapidly, turning it into what TRM referred to as a “sweeper contract that accepts directions solely from the operator”.

The signatures had been obtained upfront and fired in a single burst, and the pockets working the operation was funded by small withdrawals from Twister Money, a crypto mixing service. These options match earlier North Korea-linked thefts, TRM stated, together with Bybit.

What went incorrect

Binance’s first account pointed at one machine. A compromised laptop computer belonging to a DevOps engineer, the type of staffer who maintains the methods an trade runs on, had let an unauthorised social gathering attain a “service container” and execute withdrawal transactions.

“Now we have discovered no proof of any non-public key leaks from wallets,” the corporate stated.

By Friday, that account had widened. Binance CEO Richard Teng stated the investigation had discovered extra factors of breach and described a extra advanced assault course of.

“Our investigation has not attributed accountability to any particular person,” he wrote, including that the attacker “didn’t merely use one engineer’s permissions, and this was not a single ‘one-click’ motion”.

Deposits had been working usually by Friday morning, Teng stated, whereas withdrawals stayed paused for a safety revamp of the withdrawal service.

What about customers’ funds

Binance’s cushion for occasions like that is SAFU, the Safe Asset Fund for Customers, constructed out of a share of buying and selling charges. It held about $1 billion in crypto as of February 2026 and is managed by Nest Clearing and Custody Restricted, a regulated entity in Abu Dhabi.

In opposition to an estimated influence of $6.3 billion, almost $3 billion of it frozen on-chain, the fund covers a fraction. Teng stated firm funds can be used alongside it, “your cash is protected, and we’re protecting each loss.”

Why a part of the haul could possibly be frozen

The freezes labored as a result of a lot of what moved was stablecoins, tokens pegged to a conventional forex whose issuers can block particular addresses. Tether CEO Paolo Ardoino stated his firm froze about $1.6 billion in USDT, and Circle CEO Jeremy Allaire stated greater than $800 million in USDC had been frozen. Tether’s freeze landed 37 minutes after the primary Ethereum sweep, TRM stated.

The remaining is tougher to achieve. The attacker offered about 325 million USDT to market makers at a roughly 10% low cost for 122,300 ETH, TRM stated, and nonetheless controls about $2.4 billion in ether and bitcoin that no issuer can contact. The bitcoin was cut up into spherical 1,000 BTC and 100 BTC parcels in the identical block, muddying the path.

TRM reported in April 2026 that North Korean hackers had stolen about $577 million in crypto that yr thus far, 76% of all hack losses via April, after accounting for 64% of such losses in 2025. It put cumulative attributed North Korean crypto theft since 2017 at greater than $6 billion.

One assault has now roughly matched 9 years of it.

The place India sits on this

Binance shouldn’t be an offshore outsider in India. It registered with the Monetary Intelligence Unit, FIU-IND, as a reporting entity in August 2024, restoring Indian customers’ entry to its app and web site, after the FIU imposed a penalty of Rs 18.8 crore on it on 19 June 2024 for serving Indian purchasers “with out adhering to its statutory obligations underneath the PMLA”.

That registration brings anti-money laundering duties like KYC checks, record-keeping and reporting suspicious transactions. It is price noting that Binance has greater than 300 million registered customers in over 100 international locations and has not stated what number of had been affected, or whether or not Indian customers had been amongst them.

India has its personal file right here, on a much smaller scale. WazirX lost over $230 million in July 2024 via a multi-signature pockets, later linked to North Korea-affiliated teams, and CoinDCX misplaced $44 million on 19 July 2025 via a server-side flaw in an inner liquidity account, a loss it absorbed from its own treasury.

What occurs subsequent

Withdrawals are due again about 45 hours from Friday’s replace, which factors to Sunday, 1 November. Binance has promised an in depth technical autopsy as soon as its investigation is full, and has stated the quantity frozen could rise as it really works with legislation enforcement, issuers and blockchain intelligence corporations to hint and freeze extra belongings.

TRM stated it’s monitoring the funds and expects the following stage of laundering to run via cross-chain bridges, swap companies and over-the-counter brokers.