The cryptocurrency industry has been rocked by one of its biggest security crises after Binance, the world’s largest cryptocurrency exchange by trading volume, disclosed a cyberattack with an estimated financial impact of $6.3 billion, while reporting that approximately $3 billion of the affected assets had been frozen.
The disclosure, contained in an official security update published on Friday, October 30, 2026, followed unauthorised withdrawals from Binance-linked wallets, raising fresh concerns about the security of digital assets and the vulnerability of major cryptocurrency platforms.
Binance’s preliminary investigation suggests that the attack may have originated from a compromised laptop belonging to a DevOps engineer. The attacker allegedly used the access gained through the device to enter a service container and initiate unauthorised withdrawal transactions.
In its official statement, the exchange said the estimated financial impact was approximately $6.3 billion, adding that it had been working with blockchain partners to trace and freeze the affected assets.
“We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far,” Binance stated.
The company also disclosed that its investigation had found no evidence that any wallet private keys were leaked, although it promised to release a detailed technical post-mortem after the investigation had been completed and the facts fully verified.
Binance has pledged to absorb all losses arising from the incident through its Secure Asset Fund for Users (SAFU) and corporate funds, assuring customers that their assets remain safe.
“Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe,” the exchange said.
As part of its immediate response, the company revoked authorisation for the affected address and engaged law enforcement agencies, blockchain intelligence firms and other industry partners to trace the stolen assets and identify those responsible.
The exchange initially suspended deposits and withdrawals while carrying out emergency security checks. In a subsequent update, it said deposits were operating normally, while withdrawals remained temporarily suspended as it worked to strengthen its withdrawal systems, with resumption expected within 48 hours.
The scale of the incident has raised the possibility that it could become the largest cryptocurrency theft on record, surpassing the approximately $1.5 billion stolen from Bybit in February 2025. The Associated Press reported that blockchain intelligence firms TRM Labs and Chainalysis had linked the attack to North Korea’s TraderTraitor hacking group, although attribution remains under investigation.
The suspected involvement of a North Korean-linked cybercrime group has added an international security dimension to the incident. However, Binance has not publicly confirmed the identity of the attackers.
The attack has also unsettled cryptocurrency markets. Reuters reported that Bitcoin fell to a six-week low, while Ether also recorded losses following news of the breach. Shares of cryptocurrency-related companies came under pressure amid concerns about the potential impact on investor confidence.
Industry analysts have warned that the incident could intensify scrutiny of security arrangements at centralised cryptocurrency exchanges, particularly their withdrawal approval systems and internal access controls.
Although Binance maintains that customer assets are safe and has promised to cover the financial losses, questions remain about how an attacker could gain sufficient access to initiate withdrawals on such a massive scale.
The exchange said it was working closely with law enforcement partners to identify those responsible and bring them to justice, while promising an updated Proof of Reserves report after the security remediation process.
For millions of cryptocurrency users worldwide, the incident is another reminder that the security of digital assets depends not only on blockchain technology but also on the safeguards, internal controls and operational systems maintained by the platforms holding those assets.
