The theft of $6.3 billion from the crypto exchange Binance raises alarm and draws close scrutiny from regulators

Binance, considered the largest global platform for cryptocurrency trading, was the victim of a hacker intrusion that resulted in the theft of $6.3 billion (equivalent to R$ 33.9 billion in direct conversion) in assets held in its users' wallets. This incident is cited as the largest cyberattack ever documented involving cryptoassets, although investigations must confirm this claim.

If confirmed as the largest attack, the event at Binance would surpass the $1.5 billion loss suffered by Bybit in February 2025, an attack linked to the North Korean hacker group known as TraderTraitor.

In response to the incident, Binance announced that it will assume full responsibility for the damage caused by the attack, as disclosed in its post on the X platform. However, the company had to temporarily suspend withdrawal and deposit processes (although the latter have since been reactivated) while analyzing its systems and investigating the situation.

The cyberattack began on October 29, 2026, with most of the fraudulent transfers occurring within a twenty-minute period, despite other movements being registered in the subsequent hours.

Preliminary analysis conducted by Binance suggests that the intruders gained access to a DevOps engineer's laptop. Using this computer, the hackers allegedly managed to penetrate Binance's internal systems by leveraging the engineer's access privileges. This allowed them to execute cryptocurrency transfer transactions using the company's own system authorizations, without needing to violate or capture cryptographic keys.

Binance also communicated that it has identified other potential vulnerabilities in its systems, indicating that the engineer's laptop may have been only one of the vectors used in the attack.

According to the initial investigation conducted by the digital security firm TRM Labs, the hacker group TraderTraitor reappears as the probable perpetrator of this action.

The total amount of the loss was not higher because a significant portion of the stolen cryptoassets consisted of stablecoins, which are digital currencies pegged to the value of fiat currencies and issued by corporations capable of blocking these assets in digital wallets.

In this specific case, Tether, the issuer of the USDT stablecoin, blocked assets totaling $1.77 billion. Concurrently, Circle, responsible for USDC, froze an equivalent amount of $825 million. Furthermore, other entities, such as Ripple, also participated in the blocks.

However, cryptocurrencies like Bitcoin and Ether do not have the same blocking mechanisms, which led the intruders to attempt to convert part of the stolen stablecoins into unprotected cryptoassets. The swift actions taken by Tether, Circle, and other companies helped contain these operations.

Despite this, a considerable volume of cryptocurrencies was captured by the intruders. CEO Richard Teng and co-founder Changpeng Zhao assured that Binance will fully cover the $6.3 billion lost, using its own funds and a guarantee fund called SAFU (Secure Asset Fund for Users).

Affected customers should await further instructions provided by Binance itself.

A recent incident involving the largest theft in the crypto industry has revealed a critical weakness in the security mechanisms of crypto exchanges. Although the attack on Binance, which amounted to 6.3 billion US dollars, was not based on artificial intelligence, the development of AI calls into question the ability of any crypto exchange to guarantee the safety of client funds.

Binance, the world's largest cryptocurrency exchange, temporarily suspended withdrawal operations. The exchange promised to cover all losses from its own reserves and from the Secure Asset Fund for Users (SAFU), which serves as an emergency fund. Representatives of Binance Africa reported on Friday that 'user funds are safe.'

According to data from the analytical firm TRM Labs, the hacker moved funds from Binance wallets to 10 different blockchains on Thursday, October 29. Most of these transactions were made approximately 20 minutes after 22:05 South African time. TRM Labs estimates the total amount stolen at $6.36 billion, which is about four times the $1.5 billion stolen from Bybit in February 2025. Binance estimates the amount to be around $6.3 billion.

As of October 30, TRM calculated that about $2.7 billion was frozen, mainly in stablecoins, while Binance states this figure is around $3 billion. However, the attacker still controls about $2.4 billion in ether and bitcoin, which no issuing body can freeze. This amount is more than twice the $1 billion that Binance stated in January it had preserved in the SAFU fund.

Hendrik de Bruijn, Head of Security Consulting for Africa at Check Point Software Technologies, noted that 'the attackers did not hack the encryption or steal private keys. They seized the system that tells the keys what to sign.' Initial findings from Binance suggest that the attack may have originated from a compromised DevOps engineer's laptop—one of the employees responsible for developing and operating the exchange's software systems—which gave the attacker access to the service allowing withdrawal requests to be sent. Binance claims it found no evidence of private key leakage.

The global cryptocurrency exchange Binance has become the victim of a hack amounting to $6.3 billion, which analysts consider the largest crypto heist in history. This incident may prompt investors to reassess the risks associated with holding digital assets.

According to statements from American blockchain analysis firms TRM Labs and Chainalysis, the hackers behind the attack are allegedly from North Korea. The attackers targeted Binance wallets across 10 different blockchains and moved the majority of the funds in approximately 20 minutes, as reported by TRM Labs.

Binance stated that it cooperated with partners to freeze the affected assets, and about $3 billion has been recovered so far. The status of the remaining $3.3 billion has not been disclosed. Co-founder Yi He announced that the exchange will cover 'all losses from the hack.'

The exchange also assured users that deposits were unaffected and expected to resume withdrawals within 48 hours. TRM noted that some aspects of the attack align with previous North Korean heists, including the 2025 hack of the Bybit exchange, which was attributed to the US Federal Bureau of Investigation in Pyongyang. North Korean missions in Geneva and its embassy in China did not respond to requests for comment.

Aravind Srinivasan, Head of Systematic OTC Business at GSR, a major cryptocurrency market maker, called it the 'biggest hack in history.'

Market Reaction

Markets reacted immediately during Friday's trading in Asia. Bitcoin's price dropped by more than 3%, reaching a six-week low of $76,368, while Ethereum fell by over 3%, dropping to a two-month low of $2,178. The BNB token, originally launched as Binance Coin for paying Binance fees, lost 5% in 24 hours, settling at $709.70, according to the CoinGecko market aggregator.

Analysts believe this breach could have broader implications for the crypto industry, which is already facing pressure from rising interest rates in the US and weakening demand from ETF buyers. Tim Sun, a senior researcher at HashKey Group in Hong Kong, noted that this could further reduce risk appetite and prompt investors to re-evaluate the security of assets held on centralized exchanges, as well as counterparty, solvency, and liquidity risks.

Initial investigations suggested that the hack might have started with an infected laptop belonging to one of Binance's engineers, allowing the attacker to gain access to one of the systems and execute unauthorized withdrawals. Binance explained that the 'incident was caused by multiple factors,' and its security team is tracking the full attack path through the compromised computer that may have served as the entry point.

Binance, which allows users to buy, sell, and trade digital assets, has 335 million registered users and held assets under custody worth approximately $162.8 billion according to its 2025 annual report. The exchange stated that 'user funds remain safe.' Furthermore, it manages a user asset protection fund—a reserve composed entirely of Bitcoin—intended to protect user assets in case of a security breach.

Bernardo Brites, CEO of Trace Finance, a payment infrastructure and stablecoin company, stated: 'It is becoming very difficult to counter hacks because AI can find vulnerabilities faster than you can fix them.' He believes that users will start moving away from small and medium-sized exchanges as it becomes too risky to place money where the exchange cannot cover a significant hack.

Stablecoin issuer Tether reported freezing nearly $1.57 billion in assets related to the incident, while Circle froze over $800 million. Crypto company World Liberty Financial, associated with US President Donald Trump and his family, announced on Thursday that it had frozen funds stolen in the Binance hack, as they described it, jointly with cryptocurrency custodian BitGo. Yi reported that $27 million in stablecoins and about $2 million in World Liberty tokens were frozen.

Series of Heists

Yi also reported that the crypto company Ripple froze approximately $200 million. Jack McDonald, Vice President of Stablecoins at Ripple, stated that the company is closely monitoring reports of a potential exploit related to Binance and is freezing affected funds while coordinating with relevant parties.

The separate exchange Binance.US stated that it was unaffected. Coinbase also confirmed it was not affected and is monitoring the situation. Miguel Morel, CEO of blockchain intelligence firm Arkham, reported that data indicates billions of dollars were stolen from Binance by an unknown perpetrator.

This incident adds to a series of crypto thefts. According to TRM Labs researchers, hackers conducted nearly 150 attacks last year, resulting in the theft of $2.9 billion in cryptocurrency. In September, the exchange Bitget reported a theft of approximately $350 million in cryptocurrency from its platform.

Authorities warn that organized crime groups are increasingly using cryptocurrencies for cross-border fund transfers outside the traditional financial system. In an unrelated incident earlier on Thursday, the prediction market operator Polymarket temporarily suspended trading following a security incident involving a third-party provider but later resumed trading and promised to fully compensate affected traders.