Binance is investigating a breach that sent about $6.36 billion from wallets attributed to the exchange, a loss that TRM Labs and Elliptic describe as the largest crypto theft on record.
TRM traced transfers across 10 blockchains and valued the assets at the prices they had when moved. The transfers began at 4:05 p.m. ET Thursday (20:05 UTC) on Oct. 29, with most taking place within about 20 minutes, the firm said. Binance estimated the impact at about $6.3 billion; Elliptic put it at $6.43 billion. TRM and Elliptic compared the breach with the roughly $1.5 billion Bybit theft in February 2025, which the FBI attributed to North Korea.
Binance’s preliminary account suggested the incident may have involved a compromised laptop belonging to a DevOps engineer. The device provided access to a service container used for unauthorized withdrawals, the exchange said. Binance’s review found no indication that wallet private keys were exposed.
TRM said a transaction from an Ethereum hot wallet moved 167,464 Ether (ETH) and 63 tokens, including 1.615 billion Tether (USDT). Its analysis said a delegation approved in advance let an attacker-controlled contract run from the wallet. On other networks, TRM identified standard signed transactions, a pattern it said pointed to a breach of Binance’s hot-wallet signing systems. Binance has not released final technical findings.
Binance reported about $3 billion in frozen assets. TRM estimated roughly $2.7 billion frozen by 8:30 p.m. ET Thursday (00:30 UTC Friday); Elliptic later counted $2.84 billion in verified freezes at 3 a.m. ET Friday (07:00 UTC), using current prices.
TRM assessed with high confidence that TraderTraitor, a North Korean hacking group, was responsible. Elliptic said North Korea-linked actors were likely behind the theft. Binance said it was working with law enforcement to identify those responsible.
Binance said SAFU reserves and corporate funds would be used to cover losses. A later update said deposits were operating normally while withdrawals remained paused, with their resumption expected within 48 hours. The exchange plans to update its proof of reserves after remediation and publish a technical postmortem when its investigation is complete.
