Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Ravie LakshmananOct 30, 2026Cyber Attack / Cryptocurrency Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far. Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million USDC related to the incident, respectively. The Arbitrum Security Council is said to have executed a transaction to freeze about $30.5 million from the Binance Exploit. "Initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in an update. The company said there is no evidence of a wallet private key leak, adding it will cover all losses from the Secure Asset Fund for Users (SAFU) fund and its own funds. Out of an abundance of caution, Binance has also taken the following steps - Temporarily suspended deposits and withdrawals while security checks are completed Revoked the affected address authorization; Engaged law enforcement and blockchain intelligence partners to trace and recover funds "We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice," Binance said. In an update, Binance said it expects withdrawals to resume in 48 hours, after its team "completes a security revamp of the withdrawal service and its related addresses." The development makes it the biggest cryptocurrency heist recorded to date, surpassing the theft of about $1.5 billion from Bybit in February 2025. The incident was subsequently attributed to North Korea. "Our current estimate on the amount stolen is approximately $5.912 billion at time of theft, nearly 4x the amount stolen in the next largest crypto heist," blockchain intelligence firm Chainalysis said in an X post. Attributed to North Korea's TraderTraitor TRM Labs has attributed the record-breaking hack targeting Binance to threat actors from North Korea with high confidence. The blockchain analytics company linked it to TraderTraitor, which was also behind the 2025 Bybit heist, based on what it said were "robust on and off-chain intelligence sources." "Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst," TRM Labs said. "The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit." TRM Labs said preparation for the attack was underway at least 36 hours before the theft, with the attackers taking over a Binance hot wallet to send its "entire balance to an attacker-controlled address" - At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweeper contract that accepts instructions only from the operator. Every wallet keeps a running count of its transactions, called a nonce, and an authorization works only at the count the wallet has reached at the moment it executes. The Binance hot wallet processes a steady flow of withdrawals, so its count keeps moving forward. By preparing signatures for 50 consecutive counts, the attacker guaranteed that one would still be valid when the transaction executed. One matched, which was all the attacker needed. The signatures were produced in advance as a batch. Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT. The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains. The batch of 50 pre-signed authorizations suggests the access may have been limited in time, or that signatures had to be requested through a system. Binance has yet to publish a root cause. Chainalysis has also linked the hack to the Democratic People's Republic of Korea (DPRK) with a high degree of confidence, stating it "observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance." "The ability to quickly identify and understand illicit activity is increasingly important as North Korea increasingly uses sophisticated automation to move and obscure stolen funds," the company noted earlier this month. "Investigators must keep pace with these tactics while applying the judgment and expertise needed to make sense of complex on-chain activity." So far, Tether, Circle, Ripple, and World Liberty Financial have frozen about $2.67 billion in stablecoins, and Arbitrum's Security Council has frozen about $30 million in ETH and ARB. The attacker continues to retain control of more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, plus smaller amounts on other chains. Elliptic's chief scientist and founder, Dr. Tom Robinson, told The Hacker News cryptocurrency assets with a total value of $6.43 billion were stolen from Binance, assessing North Korea-linked actors perpetrated the theft, citing similar tradecraft and co-mingling of funds from another hack attributed to them. "Rather than stealing Binance's private keys, the attacker appears to have been able to get Binance's own systems to sign transactions on their behalf," Elliptic said. "This closely resembles the Bybit theft, in which North Korean hackers compromised a developer's machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved. In both cases, it was the infrastructure and people around the wallets that were compromised, not the cryptography." The company also noted that 2.84 billion of funds have been frozen, while the attacker is in control of around $3.33 billion of assets that cannot be frozen by an issuer and are spread across about 43 wallet addresses. This includes 511,861 ETH (1.15 billion), 18,270 BTC ($1.43 billion), 233 million XRP, and 670 million TRX. The links to North Korea are based on the following factors - Funds stolen from Binance and funds linked to the Bitget exploit have been sent to the same Ethereum address, 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7. Attackers funded their wallet with three small Tornado Cash withdrawals, tested the attack code in advance, and executed pre-signed transactions in a single burst, similar to what was observed in Bybit and KelpDAO exploits. The likely use of social engineering to trick employees into executing malware under the pretext of a coding test or a bogus project, a technique employed in DMM Bitcoin and Bybit hacks. Despite these commonalities, Elliptic has urged caution in attributing the activity to North Korea, citing deviations from previously observed laundering patterns in terms of speed and methodology, as well as the absence of a root cause. "DPRK launderers typically swap stolen stablecoins for native assets within minutes," Robinson said. "The attacker held the stolen USDT for 37 minutes on Ethereum and 46 minutes on Tron without converting most of it. North Korean-linked groups typically move funds faster and more efficiently. The use of market makers and DeFi lending protocols differs from the bridge-heavy laundering seen after the Bybit hack." When asked if there were any indicators that could have helped identify and prevent this attack beforehand, Robinson said it was possible only in hindsight. "The day before the attack, the attacker funded their wallet through the Tornado Cash mixer," Robinson added. "A few hours before, they tested their code on three wallets. None of this would have stood out at the time." Assuming the Binance hack was orchestrated by North Korea, the development once again signals how the threat actors continue to operate with impunity despite continued law enforcement efforts and sanctions pressure. "The rewards are huge and the risks to them are small," Robinson said. "The hackers are beyond the reach of law enforcement. North Korea is already heavily sanctioned, and crypto theft is one of the few ways it can still raise billions." "They target people rather than technology, through fake job offers and malware, and it only takes one compromised laptop. They then launder the funds through mixers, bridges and OTC brokers, mostly out of reach of Western law enforcement. "However, tracing and freezing have improved, which makes each theft less profitable." "Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop," Binance co-CEO Richard Teng said. "That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions." "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual." The company has since revealed that its ongoing investigation has "uncovered additional points of breach" that goes beyond the compromised laptop, and that it's "doing all we can in coordination with law enforcement to resolve it." It has also revealed that it's "recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms, and industry partners to trace, freeze and recover additional funds." (The story has been updated after publication to reflect the latest developments and additional insights from Elliptic.) Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cryptocurrency, Cyber Attack, Cybercrime, data breach, endpoint security PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Webinar Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them