Binance suffered a massive cryptocurrency breach resulting in the theft of approximately $6.3 billion. Attackers drained wallets across ten blockchains within twenty minutes on October 29, 2026. Security firms linked the incident to North Korea’s Lazarus Group, while investigators and industry partners raced to freeze billions in stolen assets.
The breach unfolded at 20:05 UTC on October 29, 2026, just as the U.S. stock market closed. Attackers targeted Binance wallets across ten blockchains, moving the majority of the funds in roughly twenty minutes. Blockchain analytics firm TRM Labs calculated total losses at $6.36 billion, marking the largest cryptocurrency exchange breach on record (Yahoo). Binance estimated the impact at approximately $6.3 billion (Dw).
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
— https://x.com/binance/status/2116089661408108712
The scale of the theft dwarfs previous cyberattacks in the digital asset sector. The incident is roughly four times larger than the $1.5 billion Bybit breach that occurred on February 21, 2025, which authorities also attributed to North Korean threat actors.
Compromised Laptop Allows Unauthorized Withdrawal Transactions
Initial findings from Binance’s ongoing investigation indicate that the breach began when a DevOps engineer had their laptop compromised. This initial access allowed unauthorized actors to reach an internal service container and submit unauthorized withdrawal transactions (Yahoo).
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj
— https://x.com/binance/status/2116121748555153621
Company leadership emphasized that the security failure extended beyond a single point of failure. Richard Teng, Binance co-CEO, noted in a public statement that the operation involved a sophisticated approach (Yahoo).
Binance later reported that subsequent investigations uncovered additional breach points (Dw). However, the company confirmed that no wallet private keys were leaked during the attack.
Attribution to North Korea’s Lazarus Group and TraderTraitor
Blockchain intelligence firms TRM Labs and Chainalysis attributed the breach with high confidence to TraderTraitor, a specialized hacking unit operated by North Korea’s state-sponsored Lazarus Group (Yahoo), (Lafm). Investigators cited robust on- and off-chain intelligence showing operational similarities to previous state-backed heists (Yahoo), (Dw).
Security researchers connected the tactics to known Lazarus operations such as DreamJob and Contagious Interview, where threat actors approach software engineers working in the cryptocurrency sector with fraudulent job opportunities to deliver malware during interview stages (Yahoo). Government agencies, including the FBI, previously blamed the same threat group for the Bybit incident in early 2025 (Yahoo).
Asset Freezes and Recovery Efforts Across Blockchains
In the hours following the breach, industry partners and security councils coordinated emergency freezes to halt the movement of stolen capital. Tether, Circle, Ripple, and World Liberty Financial froze approximately $2.67 billion in stablecoins (Yahoo), (Dw). Circle alone locked more than $800 million in USDC (Yahoo), (Dw). The Arbitrum Security Council also froze 8,426 ETH and 74.6 million ARB on its network, representing roughly $2.7 billion (Yahoo).
The Ethereum blockchain sustained the heaviest losses among the ten targeted networks, losing an estimated $3.79 billion (Yahoo).
Binance Suspends Services to Protect User Funds
Binance temporarily suspended all deposits and withdrawals following the breach to conduct security verifications and coordinate with law enforcement (Dw), (Yahoo). Executives assured customers that user funds were not directly compromised and pledged that corporate treasuries and the Secure Asset Fund for Users (SAFU) would absorb the losses (Yahoo).
Bitcoin Drops as Digital Asset Shares Fall
Financial markets reacted quickly to the news. Bitcoin dropped over 3% during early Asian trading on Friday, touching a six-week low of $76,368 (Lafm), before trading around $78,457 (Yahoo). The decline triggered more than $1.5 billion in trading liquidations across the market (Yahoo).
Equities tied to the digital asset sector also saw downward pressure. Coinbase shares fell 4.82% in after-hours trading, though analysts noted that decline also reflected a third-quarter earnings report released the same afternoon (Yahoo). Robinhood and Circle experienced similar after-hours pullbacks (Yahoo).
Security researchers warned that the incident could provoke secondary phishing campaigns (Yahoo). As investigations continue, authorities and blockchain firms have not established the final recovery total for the billions still un-frozen, and Binance has not announced a definitive timeline for resuming normal user withdrawals (Dw), (Yahoo).