Binance reports security incident; estimates put losses near $6.3 billion, and analysis firms blame North Korean hackers

Binance confirmed a security incident and suspended withdrawals, TechCrunch reported on Oct. 29. The company paused withdrawals on multiple networks as a precaution. By Oct. 30, security researchers were saying hackers had taken at least $6.3 billion from Binance wallets.

The amount. TechCrunch attributes the $6.3 billion figure to security researchers. Engadget, citing The New York Times, also reports an estimated $6.3 billion loss. Engadget adds that a Binance website article put the estimated total impact at around $6.3 billion. Early estimates differed. TechCrunch reported on Oct. 29 that crypto watchers cited at least $2 billion and some estimates above $5.7 billion, all unconfirmed at the time. TechCrunch says the amount stolen may still change. Engadget says the figure would be a record if accurate and compares it with a roughly $1.5 billion hack of Bybit last year. TechCrunch puts that earlier theft at $1.4 billion.

What Binance says. In a post on X, Binance said its initial investigation points to a compromised engineer's laptop, which it said let an attacker reach a service container and submit unauthorized withdrawals, according to TechCrunch. Binance said it has seen no evidence that private keys leaked. It says "user funds are safe" but did not immediately provide proof, TechCrunch reports. It plans to publish an updated proof of reserves once remediation is complete. Engadget reports that the Binance website article said losses would be covered from SAFU and company funds.

Recovery. A Binance spokesperson said about $3 billion has been frozen by industry partners, according to TechCrunch. Binance said it has begun recovering affected assets and is working with law enforcement. TechCrunch also reported freezes of about $800 million by Circle and about $1.56 billion by Tether related to the hack. Engadget gives different figures for these freezes, so the amounts vary by source.

Who is blamed. TRM Labs and Elliptic both attributed the theft to North Korean hackers, TechCrunch reports. According to TRM, the theft took about 20 minutes. Engadget reports that TRM attributed the attack to TraderTraitor and made the judgement with "high confidence". Engadget also reports that Tim Sun of HashKey Group told Reuters the hack may dampen risk appetite and prompt investors to reassess the safety of assets on centralized exchanges.

What we don't know yet

• Final total. Researchers, press reports and Binance's website article all point to about $6.3 billion, but the figure is an estimate. TechCrunch says it may change and that the incident is not confirmed as resolved.
• Deposits. TechCrunch says Binance suspended all deposits and withdrawals. Engadget reports that Binance described deposits as normal and froze only withdrawals. The accounts differ, and the reports may reflect different times.
• How the breach worked. Binance's investigation is at an early stage. Engadget's account of the company's statement is more tentative than TechCrunch's, saying the compromise may have enabled access. TechCrunch says it is unclear how the engineer's laptop was compromised.
• How much is frozen. TechCrunch attributes a figure of about half of the $6.3 billion to security researchers. A Binance spokesperson said about $3 billion. Freeze figures for Circle and Tether also differ between sources.
• Proof that user funds are safe. TechCrunch reported that Binance did not immediately provide proof. Binance says it will publish an updated proof of reserves once remediation is complete.
• Attribution. The North Korea attribution described here comes from TRM Labs and Elliptic. The sources used for this story do not cite a government attribution.
• Separate incident. TechCrunch reported that Polymarket briefly halted trading after a third-party vendor was compromised. It describes this as what appears to be a separate incident.