Binance breach affects about $6.3 billion in assets, weighs on crypto stocks
Key Facts
Binance estimated the breach’s total impact at about $6.3 billion, after its initial investigation indicated that a DevOps engineer’s computer may have been compromised and used to gain access to a service container and send unauthorized withdrawal transactions. The exchange said it had found no evidence that private wallet keys had been leaked. TRM Labs estimated that the attacker moved about $6.36 billion from Binance wallets across 10 blockchains on October 29, with most transfers occurring within about 20 minutes. The difference between the estimates of the total impact and the value of assets moved reflects two figures reported by Binance and TRM Labs. Binance said it would publish further technical details after the investigation was complete and the facts had been verified.
TRM Labs attributed the attack, with what it said was a high degree of confidence, to the North Korea-linked TraderTraitor group, while Chainalysis made the same assessment. TRM Labs said: "We make this assessment with a high degree of confidence." The attribution places responsibility for the attack within a blockchain analytics firm’s assessment, rather than a publicly announced official investigation finding. The initial technical account focuses on a DevOps engineer’s computer and access to a service container, while Binance said it had found no evidence that wallet keys were leaked. The company said it would disclose further details after the investigation was complete and the facts had been verified.
Binance said its partners had frozen about $3 billion in on-chain assets as of October 30. That action does not mean the assets were returned to the exchange or its users. Finance Magnates reported that the U.S. Secret Service was working with Circle to recover the funds, citing Crypto Briefing’s report on the cooperation, and said the effort also involved the FBI and companies in the cryptocurrency sector. Reuters, via Investing.com, reported that Binance was working with law enforcement agencies around the world, including the FBI and the U.S. Secret Service. Binance said it was also cooperating with blockchain analytics firms, token issuers and other platforms to track and recover the funds.
Binance allocated more than $6.34 billion of its own funds to cover the stolen assets, according to the Associated Press. The exchange said it would cover the losses with its own funds, while the agency reported that it had pledged to cover all losses and had begun restoring assets to users. Loss coverage remains separate from the freezing of on-chain assets, as Binance has not said that all frozen funds have been recovered. The company said deposits and withdrawals were temporarily suspended during security checks. It also revoked the authorization associated with the affected address and engaged law enforcement and blockchain analytics partners to track the funds, according to its October 30 statement.
Coinbase and Strategy shares plunged 12% on Friday, October 30, while Robinhood fell about 9%, according to CoinDesk. The Associated Press gave a different estimate for the same session, saying Coinbase fell 13.6% and Strategy declined 8.3%. Coinbase closed at $160.59 on October 29, according to EL7 data. Coinbase fell despite reporting results for the latest quarter that topped analysts’ expectations, according to the Associated Press. The losses in crypto stocks coincided with a broad decline in technology shares, the agency said.
The pressure extended to Bitcoin, which fell 3.2% on Thursday evening, October 29, to below $79,000, according to the Associated Press. On October 30, it was below $77,000 after topping $86,000 earlier in the month, the agency said. Analysts at Cantor Fitzgerald, TD Cowen and Compass Point said they did not yet see signs of a broader threat to the cryptocurrency market. Compass Point analysts said Binance had sufficient liquidity to cover customer losses. A TD Cowen analyst said the breach targeted Binance’s transaction-signing infrastructure, not the Bitcoin network itself, a distinction that separates a platform breach from the network’s security.
Binance is working with law enforcement agencies, specialist firms and currency issuers to track and recover the assets, while saying withdrawals remained suspended during security checks. The company said it would publish a proof-of-reserves update after the remediation was complete. In a parallel regulatory development, the U.S. Commodity Futures Trading Commission is targeting December 14, 2026, to issue a proposed rule for a voluntary registration framework for offshore platforms serving U.S. retail traders, according to Finance Magnates. The target date comes as security agencies track the funds and the technical investigation continues, while Binance has yet to announce when withdrawals will resume. The company said further technical details would be released after the investigation was complete and the facts had been verified.