Binance reports $6.3 billion security breach, freezes $3 billion in assets

two men shaking hands over a wooden object — Marek Studzinski / Unsplash

Binance is investigating a security incident detected on Thursday, October 29, in which large volumes of cryptocurrency were transferred from hot wallets to newly created addresses. The platform reported that approximately $6.3 billion in assets were affected by the unauthorized transactions.

The initial investigation indicated that the breach involved a compromised laptop belonging to an engineer on the company's DevOps team. This device reportedly allowed the attacker to access a service container and initiate unauthorized withdrawal transactions. Subsequent analyses suggested the attack involved multiple factors and other points of entry, though further details have not yet been shared. Binance stated that the attack was complex and that the company is coordinating with law enforcement authorities to resolve the issue while continuing to gather facts.

In a statement sent to the press on Friday, October 30, BBrasil SPSAV LTDA., the entity of Binance serving Brazilian users, asserted that customer funds remain secure. The company confirmed that it has reserved more than $6.34 billion to cover the incident. Of this amount, approximately $5 billion is held in the same tokens that were affected. Binance stated that if there is any impact, it will cover all losses directly related to the incident using its own resources, including the Secure Asset Fund for Users. The company also apologized to its clients for the disruption.

As a containment measure, Binance temporarily suspended asset withdrawals to conduct a thorough security verification. Deposits and normal platform activity were not affected. The company expects withdrawals to resume within a 48-hour window, although this timeline may change during the ongoing security checks. Binance has not officially identified the perpetrators of the attack. However, the blockchain intelligence firm TRM Labs attributed the operation to the TraderTraitor group, a hacking collective associated with North Korea, with high confidence. TRM Labs noted that the attack method shares characteristics with other operations attributed to North Korean cybercriminals, including the 2014 Sony Pictures hack. The attacker moved approximately $6.36 billion across ten cryptocurrency networks, concentrating the majority of the transactions within 20 minutes.

Binance reported that $3 billion in assets have been frozen with the help of industry partners. The company is working with these partners and law enforcement to recover the frozen assets. These figures do not include other protected assets that remain subject to recovery and verification processes. There is no evidence that private keys from any wallets were leaked.

Binance recommends that users remain vigilant against scams, trust only official channels, and never share account access information with third parties. Users do not need to take any specific action to protect their cryptocurrencies at this time. In case of doubts or suspicious account activity, the company advises contacting official support directly.