A massive security breach at Binance has resulted in approximately $6.3 billion in cryptocurrency being transferred out of the exchange’s wallets, with blockchain intelligence firm TRM Labs attributing the attack to TraderTraitor, a North Korean-linked hacking group.
According to TRM Labs, approximately $6.36 billion was moved from Binance wallets across 10 blockchains on October 29, with most of the transfers taking place within around 20 minutes. The firm said its attribution to TraderTraitor was based on on-chain and off-chain intelligence and expressed high confidence in its assessment.
In this story
2 assets
Binance’s preliminary investigation indicated that the attacker may have gained access through an engineer’s compromised laptop. This reportedly allowed unauthorized access to a service container used to submit withdrawal transactions. Binance has said it found no evidence that wallet private keys were leaked and pledged to cover the losses, stating that user funds remain safe.
The incident also triggered a rapid response from cryptocurrency companies and blockchain networks. TRM Labs estimated that approximately $2.7 billion in assets had been frozen, while Binance put the amount at around $3 billion.
One of the most notable parts of the incident involved approximately 18,270 BTC, worth around $1.4 billion at the time. The Bitcoin was distributed across 19 wallets, including 17 addresses holding exactly 1,000 BTC each. The funds had not moved onward at the time of the reported blockchain tracking.
The scale of the incident highlights the risks associated with centralized exchange infrastructure and the growing importance of internal security controls. Although parts of the stolen funds have reportedly been frozen, billions of dollars in cryptocurrency may remain under the attacker’s control.
