Binance, the world's largest cryptocurrency exchange, has suffered what analysts describe as the largest crypto theft on record, with about $6.3 billion moved out of its wallets on Thursday, 29 October. According to blockchain intelligence firm TRM Labs, most of the transfers happened in about 20 minutes, across ten blockchains.

Binance said its initial investigation pointed to a compromised laptop belonging to an engineer, which gave an attacker access to a service container used to submit unauthorised withdrawals. Binance said user funds were safe and that losses would be covered by its emergency fund and other resources, and it later said it had set aside $6.34 billion of its own funds to cover the incident.

Where the money went

Analysts estimate about $6.36 billion was moved, but roughly $3 billion in stablecoins was frozen by issuers including Tether, Circle and Ripple, making those funds unusable. TRM Labs estimated about $2.4 billion in Bitcoin and Ether is beyond immediate recovery, since those assets cannot be frozen in the same way.

Binance suspended withdrawals while it investigated, with deposits remaining open, and said withdrawals were expected to resume within about 48 hours. Markets reacted sharply: Bitcoin fell to a six-week low on Friday trading.

Who analysts blame, and what is unproven

TRM Labs and Chainalysis said the attack bears the hallmarks of TraderTraitor, a hacking unit they link to North Korea. Binance itself has not identified the attackers, and North Korea routinely denies involvement in cyber theft. That attribution therefore remains an analysts' assessment, not a confirmed finding.

The scale dwarfs last year's $1.5 billion Bybit theft, also attributed by the FBI to North Korean hackers.