Binance, considered the largest global platform for cryptocurrency trading, was the victim of a hacker intrusion that resulted in the theft of $6.3 billion (equivalent to R$ 33.9 billion in direct conversion) in assets held in its users' wallets. This incident is cited as the largest cyberattack ever documented involving cryptoassets, although investigations must confirm this claim.
If confirmed as the largest attack, the event at Binance would surpass the $1.5 billion loss suffered by Bybit in February 2025, an attack linked to the North Korean hacker group known as TraderTraitor.
In response to the incident, Binance announced that it will assume full responsibility for the damage caused by the attack, as disclosed in its post on the X platform. However, the company had to temporarily suspend withdrawal and deposit processes (although the latter have since been reactivated) while analyzing its systems and investigating the situation.
The cyberattack began on October 29, 2026, with most of the fraudulent transfers occurring within a twenty-minute period, despite other movements being registered in the subsequent hours.
Preliminary analysis conducted by Binance suggests that the intruders gained access to a DevOps engineer's laptop. Using this computer, the hackers allegedly managed to penetrate Binance's internal systems by leveraging the engineer's access privileges. This allowed them to execute cryptocurrency transfer transactions using the company's own system authorizations, without needing to violate or capture cryptographic keys.
Binance also communicated that it has identified other potential vulnerabilities in its systems, indicating that the engineer's laptop may have been only one of the vectors used in the attack.
According to the initial investigation conducted by the digital security firm TRM Labs, the hacker group TraderTraitor reappears as the probable perpetrator of this action.
The total amount of the loss was not higher because a significant portion of the stolen cryptoassets consisted of stablecoins, which are digital currencies pegged to the value of fiat currencies and issued by corporations capable of blocking these assets in digital wallets.
In this specific case, Tether, the issuer of the USDT stablecoin, blocked assets totaling $1.77 billion. Concurrently, Circle, responsible for USDC, froze an equivalent amount of $825 million. Furthermore, other entities, such as Ripple, also participated in the blocks.
However, cryptocurrencies like Bitcoin and Ether do not have the same blocking mechanisms, which led the intruders to attempt to convert part of the stolen stablecoins into unprotected cryptoassets. The swift actions taken by Tether, Circle, and other companies helped contain these operations.
Despite this, a considerable volume of cryptocurrencies was captured by the intruders. CEO Richard Teng and co-founder Changpeng Zhao assured that Binance will fully cover the $6.3 billion lost, using its own funds and a guarantee fund called SAFU (Secure Asset Fund for Users).
Affected customers should await further instructions provided by Binance itself.
