Binance has frozen approximately $3 billion in cryptocurrency assets following a massive security breach that exposed about $6.3 billion across multiple blockchains, in what could become the largest cryptocurrency heist on record and raises fresh questions about the security of digital asset exchanges.
The world’s largest cryptocurrency exchange by trading volume said preliminary investigations traced the breach to a compromised laptop belonging to a DevOps engineer, which allegedly enabled an attacker to gain access to a service container and execute unauthorised withdrawals from its hot wallets.
The attack, which occurred on October 29, reportedly drained assets across at least 10 blockchain networks within approximately 20 minutes, involving substantial amounts of Bitcoin, Ethereum, stablecoins and other digital assets.
Binance said its investigation had found no evidence that wallet private keys were compromised, suggesting that the breach exploited weaknesses in its operational infrastructure rather than a direct compromise of cryptographic keys.
The exchange immediately suspended deposits and withdrawals as a precaution while securing its systems and working with blockchain networks, security firms and stablecoin issuers to trace and restrict the movement of stolen assets.
About $3 billion has so far been frozen on-chain, largely involving USDT and USDC stablecoins issued by Tether and Circle. However, approximately $3.3 billion in other assets, including Bitcoin and Ethereum, remains outside immediate recovery because these cryptocurrencies do not have central issuers capable of freezing individual holdings.
Blockchain intelligence firm TRM Labs attributed the attack with high confidence to TraderTraitor, a hacking group linked to North Korea, citing technical and on-chain indicators. The firm identified sophisticated techniques, including Ethereum’s EIP-7702 delegation mechanism, which reportedly enabled the attackers to turn a compromised hot wallet into a mechanism for transferring assets.
Binance has pledged to absorb the losses using its Secure Asset Fund for Users (SAFU) and corporate resources, maintaining that customer funds remain safe despite the scale of the breach.
The incident has renewed scrutiny of the security architecture of major cryptocurrency exchanges, particularly the risks associated with hot wallets, which hold assets connected to online systems and are therefore more exposed to cyberattacks than offline storage.
The breach also raises questions about the effectiveness of internal access controls and employee-device security, given that investigators believe a compromised laptop may have provided the entry point for an operation that drained billions of dollars across multiple blockchain networks.
The scale of the incident dwarfs the $1.5 billion Bybit hack in 2025, previously regarded as the largest cryptocurrency theft on record. The latest breach also exceeds estimates of total cryptocurrency theft across multiple incidents in 2025.
Financial markets reacted to the incident with heightened risk aversion, as Bitcoin fell below $78,000 and cryptocurrency markets recorded approximately $1.5 billion in liquidations, reflecting renewed concerns about the operational risks surrounding major digital asset platforms.
Binance said it had revoked affected address authorisations and engaged law enforcement agencies and blockchain intelligence partners to trace the stolen funds and pursue further recoveries. It also promised to publish a detailed technical post-mortem after completing its investigation and update its Proof of Reserves following remediation.
Beyond the immediate financial exposure, the breach places pressure on Binance to demonstrate that its security controls can prevent similar attacks, particularly as institutional investors and retail users increasingly depend on centralised exchanges to hold and trade digital assets.
The ability to recover the remaining funds, restore confidence and establish how a single compromised device could trigger withdrawals across multiple networks will be central to determining the wider implications of the incident for the global cryptocurrency industry.
Royal Ibeh is a senior journalist with years of experience reporting on Nigeria’s technology and health sectors. She currently covers the Technology and Health beats for BusinessDay newspaper, where she writes in-depth stories on digital innovation, telecom infrastructure, healthcare systems, and public health policies.
