Binance freezes $3 billion after record crypto theft
Crypto platforms can now interrupt laundering across multiple blockchains
Overview
About $6.3 billion in cryptocurrency was moved from wallets on October 29, making it the largest reported crypto theft. Most transfers crossed 10 in about 20 minutes, followed by another wave. said a hacker may have used an engineer’s laptop to enable withdrawals, rather than breaking into the . It suspended deposits and withdrawals, promised to cover customer losses, and worked with partners to freeze about $3 billion. Withdrawals were expected to resume after security changes.
and said with high confidence that North Korea’s group carried out the theft. Investigators also linked the group to the $1.5 billion Bybit theft in February 2025. This remains an assessment from tracking blockchain transactions, not a formal government confirmation. Public ledgers helped trace the money, while exchanges and could freeze assets they controlled. Rapid movement across may still make recovery difficult, leaving the investigation, affected wallets, and unfrozen funds under review.
Timeline
Binance’s investigation continued while frozen funds and wallet activity remained under review
Binance and outside investigators continued tracking after the initial transfers and later wave of activity. The amount frozen was reported at roughly $3 billion, although the figure could change as more assets were identified or restricted. The latest reporting established an ongoing investigation and substantial containment, but not full recovery or a formal government finding of North Korean responsibility.
Investigators used cross-chain tracing and centralized freezes to limit laundering
Investigators followed the stolen assets as they moved between networks and into addresses associated with the attackers. Exchanges and issuers could freeze funds when those assets reached platforms or tokens governed by . The response exposed both sides of crypto infrastructure, preserve a trace, but recovery depends on fast coordination and identifiable control points.
Chainalysis independently assessed TraderTraitor as the likely perpetrator
reached a similar conclusion, assessing with high confidence that the theft was the work of North Korean cybercrime group TraderTraitor. Its analysis tracked approximately $6.4 billion in unauthorized transfers across . The agreement between major tracing firms strengthened the attribution assessment while leaving formal state responsibility unconfirmed.
TRM Labs linked the Binance operation with high confidence to North Korea’s TraderTraitor group
TRM Labs assessed that , a North Korea-linked hacking group, carried out the operation. Its conclusion relied on , including the movement patterns and links among attacker-controlled addresses. The assessment was an investigator attribution, not a formal government confirmation that North Korea ordered or conducted the theft.
Binance and blockchain partners froze about $3 billion in stolen assets
Binance coordinated with blockchain analytics firms, exchanges and asset issuers to identify and restrict funds linked to the theft. Approximately $3 billion had been verified as frozen, with among the centralized actors able to intervene when assets reached controllable addresses. The result showed that on-chain movement is traceable and that rapid coordination can interrupt laundering.
Binance halted withdrawals while responding to the security breach
Binance temporarily halted withdrawals as it investigated the incident and worked with partners to freeze affected assets. The exchange said customer funds were safe and that it would cover hacking losses.
Binance said a compromised engineer laptop may have enabled unauthorized withdrawals
Binance’s preliminary account pointed to an engineer’s hacked laptop as a possible access path for the unauthorized withdrawals. The finding indicated a compromise of exchange-related infrastructure rather than a simple attack on the underlying public blockchains. Binance initially did not publicly identify a responsible hacking group.
Attackers used rapid cross-chain transfers to complicate containment
The stolen assets were sent from Binance-attributed wallets to across multiple networks. The speed of the initial sweep limited the time available for Binance and its partners to react. Moving assets across chains also created a fragmented trail that required investigators to correlate activity across separate blockchain ecosystems.
Attackers moved about $6.3 billion from Binance wallets across 10 blockchains
Unauthorized transfers began on October 29 and affected Binance wallets on 10 , including Bitcoin, Ethereum, Tron and XRP-related networks. TRM Labs estimated the transfers at approximately $6.36 billion, with most of the funds moved in roughly 20 minutes.
North Korea-linked attackers stole about $1.5 billion from Bybit
The Bybit theft became the largest previously confirmed cryptocurrency heist. Investigators later cited similarities between that operation and the suspected activity in the Binance case. The comparison helped establish a possible recurring North Korean cyber-financing pattern, but it did not by itself prove responsibility for the Binance theft.