The vault held. The system that opened it did not.
Binance, the world's largest cryptocurrency exchange by trading volume, said on Friday that the estimated impact of its security breach is around $6.3 billion, with roughly $3 billion in affected assets frozen on-chain so far. That makes it the biggest crypto theft on record, about four times the $1.5 billion taken from Bybit in February 2025.
"Our initial investigation suggests this security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," the company said in an update. "We have found no evidence of any wallet private key leak."
Co-CEO Richard Teng pushed back on the idea that one employee's access was enough. "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process," he said. Binance later said it had "uncovered additional points of breach" and was still gathering facts.
Blockchain intelligence firm TRM Labs said an attacker moved about $6.36 billion out of Binance wallets across ten blockchains on October 29, most of it in roughly 20 minutes from 20:05 UTC. TRM and Chainalysis both attributed the attack to TraderTraitor, a North Korean state-backed unit also tracked as Lazarus Group. Binance has not named any group and said the investigation has not attributed responsibility to an individual.
Freezes have narrowed the gap. Tether, Circle, Ripple and World Liberty Financial blocked about $2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB. TRM estimates the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach, having sold USDT to market makers and borrowed ETH against USDT on Aave to outrun the freezes.
For users, the company's line is simple. "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe," it said, adding that an updated Proof of Reserves will follow remediation.
Withdrawals have been suspended while the withdrawal service and related address controls are overhauled. Deposits are unaffected, the affected address authorisations have been revoked, and Binance says it is on track to resume withdrawals in about 45 hours. Binance Alpha trading was also suspended.
Markets felt it. Bitcoin fell more than 4% to $77,994.96 on Friday, and Circle's shares dropped about 5% in after-hours trade.