Binance freezes withdrawals after $6.3bn breach blamed on North Korean hackers

Binance, the world's largest cryptocurrency exchange, has frozen withdrawals after attackers made off with digital assets worth more than $6.3bn (£4.7bn), a theft widely attributed to North Korean hackers. According to The Guardian's live coverage on October 30, the intrusion appears to have begun with the hack of a laptop belonging to one of the exchange's engineers.

How the attack unfolded

Binance co-CEO Richard Teng, posting on X, said the initial investigation suggests the incident started with a compromised laptop belonging to a DevOps engineer. That foothold gave the attacker access to a service container, from which they submitted unauthorised withdrawal transactions.

Teng insisted the attack was more complex than a single careless click by one employee, and said the investigation has not assigned responsibility to any individual. He also said there is no evidence so far that any wallet private keys were leaked.

The exchange has temporarily halted withdrawals while it overhauls the security of its withdrawal service and related addresses, revoked the authorisations on affected addresses, and engaged law enforcement and blockchain intelligence partners to trace and recover funds. Teng said deposits were running normally, though Deutsche Bank strategist Jim Reid described the exchange as having suspended both deposits and withdrawals.

Attribution and the missing billions

Chainalysis co-founder and CEO Jonathan Levin wrote on X that his firm assesses the theft, which he valued at $6.4bn and slightly above Binance's own roughly $6.3bn estimate, was likely the work of North Korea's TraderTraitor group, citing links to a previous hack. Industry partners have frozen about $3bn so far, he said, and Chainalysis is continuing to follow the funds.

According to Decrypt, the attacker has been converting stablecoins, which issuers can freeze, into ether, which has no issuer and cannot be blacklisted. Tether and Circle moved quickly to blacklist the suspected attacker's addresses, locking up more than $2bn of tokens, but funds converted to ETH before a freeze lands are beyond the issuers' reach.

What was taken

Blockchain analytics firm TRM published a chain-by-chain breakdown. Ethereum accounts for the largest share at roughly $3.79bn, comprising 200,630 ETH plus 185 other tokens, including 1.875bn USDT, 823m USDC and 88.5m RLUSD. Bitcoin outflows totalled 18,270 BTC, about $1.47bn, followed by around $628m from Tron, $296m from the XRP Ledger, $96m from Solana, $39m combined across Arbitrum, Optimism and Base, $28m from Avalanche and $10m from Polygon.

Markets slide and experts sound alarms

Most major cryptocurrencies fell after the news broke, according to Coinmarketcap data cited by The Guardian: bitcoin dropped 2.35% to $77,940, ether slipped 3.6% to $2,227, and Binance's own BNB token fell 5.6% to $706.

Jake Moore, global cybersecurity advisor at ESET, said it was troubling that a single device held enough privileged access to enable transfers of this size, arguing that attackers will keep targeting systems and people until they find a weak link, and there is always one. He urged consumers to spread their holdings across multiple reputable platforms and hardware wallets.

Cristiano Ventricelli, vice president of digital assets at Moody's Ratings, said the incident highlights the cybersecurity risks of hot wallets, already exposed by the 2025 hack of the Bybit exchange, and the concentration risk inherent in large, centralised intermediaries whose scale of custody amplifies the damage of a successful breach.

Why it matters

A theft of this size at the industry's biggest exchange is a stress test for crypto custody itself. Binance has pledged to cover every loss through its SAFU fund and company funds, a promise echoed by co-founder Yi He, but with roughly $3.3bn still unaccounted for, the final bill is unknown. The response also shows both the strength and the limits of on-chain crisis tools: issuers froze billions in stablecoins within hours, yet the attacker's pivot to ether exposes what happens when there is no central party left to call. The broader questions raised by ESET and Moody's, about privileged access, hot wallet exposure and regulation lagging behind the technology, will persist long after this incident, and Moody's warns that the industry impact depends on how much is recovered and whether confidence holds across the digital-asset ecosystem.