Binance reports $6.3 billion cyberattack, North Korean hackers suspected

The company said on October 30 that approximately $3 billion in affected assets had already been frozen with the help of blockchain partners. Binance pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and company funds.

According to Binance's preliminary investigation, the attackers may have compromised a DevOps engineer's laptop, gaining access to the exchange's internal infrastructure and initiating unauthorized withdrawal transactions.

The company said it had found no evidence that cryptocurrency wallet private keys were leaked.

Binance temporarily suspended deposits and withdrawals while conducting security checks, revoked the affected address authorization and contacted law enforcement and blockchain intelligence specialists to help trace and recover the assets.

According to Reuters, US blockchain analytics company TRM Labs suspects North Korean hackers were behind the attack. The perpetrators reportedly targeted Binance wallets across 10 blockchain networks and transferred most of the funds within approximately 20 minutes.

TRM Labs identified similarities with previous cyberattacks attributed to North Korea, including the 2025 hack of cryptocurrency exchange Bybit, which the FBI linked to Pyongyang.

Binance co-founder Changpeng Zhao, who no longer runs the exchange but remains its largest shareholder, initially said the incident appeared to be a hack while assuring customers that their funds were safe.

"User funds are safe!" Zhao wrote on X, thanking stablecoin issuers Tether and Circle for rapidly freezing affected assets.

Bloomberg reported that Bitcoin fell 3.7% following the initial reports of the suspected breach, dropping below $79,000 to its lowest level since September. Other cryptocurrencies also declined.

Binance said it would publish a detailed technical report once its investigation was complete, along with updated proof of reserves.