Binance now says a compromised laptop was not the only way in. Its investigation has “uncovered additional points of breach” in the attack that hit about $6.3bn of its assets on Thursday, the world’s largest crypto exchange said on Friday.
Binance said in an investigation update on X that it will cover all losses and has frozen about $3bn so far. Blockchain analytics firm TRM Labs puts the theft at $6.36bn in a report on the Binance hack. It calls it “the largest crypto theft on record” and attributes it to TraderTraitor, a North Korean state hacking unit. The previous record was the $1.5bn taken from rival exchange Bybit in February 2025.
“Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance said.
Its first update, on Thursday night, said a compromised DevOps engineer’s laptop may have let an attacker into a service container to submit unauthorised withdrawals. A later service update said the incident “stems from multiple factors”, with the compromised computer a possible entry point. A root-cause report will follow, Binance said.
Binance said it has found no evidence of any wallet private key leak. It will cover the losses from its Secure Asset Fund for Users (SAFU), an emergency reserve, and from company funds.
Twenty minutes on ten blockchains
The money started leaving Binance wallets at 20:05 UTC on 29 October, according to TRM. Most of it moved in about 20 minutes, across ten blockchains including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. A second wave hit wallets on Avalanche and Polygon around 23:05 UTC.
Preparation began at least 36 hours earlier, TRM said. The attacker funded a wallet with small withdrawals from Tornado Cash, a service that hides where crypto comes from. It then rehearsed the attack on test wallets.
On Ethereum, the attacker used a feature called EIP-7702 to hand control of a Binance “hot wallet” to its own code. A hot wallet is one an exchange keeps online to pay out customer withdrawals. One transaction then moved 167,464 ETH and 63 other tokens, including 1.615 billion USDT, TRM said.
Wallets on the other chains sent funds through ordinary signed transfers in the same half hour. In TRM’s assessment, that points to an attacker who could make Binance’s signing system approve transactions on many chains. “Binance has yet to publish a root cause,” TRM wrote.
Binance co-CEO Richard Teng said the attack was not a matter of one person’s access.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” Teng wrote on X.
He said the investigation has not attributed responsibility to any individual.
The freezes
Stablecoin issuers, which can block their own tokens, froze stolen funds within the hour. Tether froze 971.1 million USDT at 21:01 UTC, according to TRM. Circle froze 823 million USDC three minutes later. Ripple, World Liberty Financial and the Arbitrum network’s Security Council also froze funds.
TRM counted about $2.7bn frozen on-chain by 00:30 UTC on Friday. Binance’s figure is about $3bn. The attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4bn that no issuer can freeze, TRM said.
Before the freezes spread, the attacker sold about 325 million USDT for ETH at a discount of more than 10%, TRM said. It also borrowed ETH against USDT on the lending protocol Aave. Aave then froze the affected markets. The outflows stopped when Binance paused withdrawals, the exchange said.
Who is blamed, and who denies it
TRM said it makes its North Korea judgment “with high confidence”, based on on-chain and off-chain intelligence. The FBI named the same group as behind the Bybit theft, TRM noted. Chainalysis, another analytics firm, also tied the attack to the group and estimated $5.912bn stolen at the time of the theft.
Binance has not named a culprit. North Korea has denied involvement in hacks in the past, Osmond Chia reported for the BBC. In September, Bitget said it suspected North Korean hackers in the Bitget hack of its hot wallets. This month, the US charged 14 people over a scheme placing North Korean IT workers at more than 70 companies. The country’s hackers are also building their own AI tools.
What happens next
Binance suspended deposits and withdrawals on Thursday night. By Friday, it said deposits were operating normally. It is on track to resume withdrawals within 45 hours of its latest update, after a security revamp of its withdrawal service. Binance.US, a separate company, said it was not affected.
Bitcoin fell below $77,000 for the first time in more than a month on the news, Muyao Shen and Vildana Hajric reported for Bloomberg. Binance said it will publish a technical post-mortem and an updated proof of reserves once its investigation is complete.