Key Takeaways
- • Hackers stole about US$6.3 billion (S$8 billion) from Binance, the world's largest cryptocurrency exchange, in what is described as the largest digital asset theft on record.
- • The bulk of the heist was completed in roughly 20 minutes, beginning shortly after 2000 GMT on Oct 29 (4am SGT, Oct 30), according to blockchain records.
- • Attackers compromised Binance's signing infrastructure, which authorises transactions, per TRM Labs, allowing them to issue instructions that emptied affected wallets.
- • About half of the stolen assets were stablecoins since frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, limiting the attackers' ability to convert them to cash.
- • Several blockchain analysis firms link the attack to North Korean hackers, with TRM Labs stating it is highly confident the same group behind the 2025 Bybit attack was responsible.
Summary
Hackers stole US$6.3 billion (S$8 billion) from Binance, the world's biggest cryptocurrency exchange, in a record digital asset theft. According to the exchange and expert analysis of blockchain records, about US$6.3 billion of cryptocurrencies were drained from wallets Binance uses to process transactions. Binance said in a statement on X that it initially believed the attack involved a compromised laptop, but that its subsequent investigation had uncovered additional points of breach. The exchange operates a secure asset fund, a US$1 billion bitcoin reserve designed to protect customers in a security breach, according to its website. Co-chief executive Richard Teng said losses would be covered by the fund and company resources.
According to TRM Labs, attackers compromised Binance's signing infrastructure, which authorises transactions, allowing them to issue instructions that emptied the affected wallets. Blockchain records show the bulk of the heist unfolded in about 20 minutes, beginning shortly after 2000 GMT on Oct 29. Once funds were moved, attackers raced to shift them beyond the reach of Binance counterparties and stablecoin issuers, which have frozen roughly half of the stolen assets. Joshua Chu, a Hong Kong lawyer who works on crypto cases, said the attacker may not have stolen the vault key but may have hijacked the system that tells the vault to release money.
Several US blockchain analysis firms said the attack bears similarities to previous operations attributed to North Korean hackers. Teng said Binance's investigation had not yet identified the attackers, and North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts. TRM said the breach shared characteristics with the 2025 attack on crypto exchange Bybit, which the FBI attributed to North Korean hackers, and that it was highly confident the same group was responsible. Chainalysis said funds stolen in a September attack on Bitget were being mixed with proceeds from the Binance breach.
About half the stolen assets were stablecoins frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, the Trump family's crypto venture. Freezing does not guarantee return of the coins to Binance, but it significantly limits the attackers' ability to convert them into cash. TRM estimated that about US$2.4 billion in bitcoin and ether is beyond reach, and said some funds had already been posted as collateral to borrow ether. Patrick Tan, general counsel of ChainArgos, noted that no company can freeze bitcoin or ether, which can be stopped only if sent to an exchange or broker willing to freeze them or if law enforcement obtains the private keys. Bernardo Brites, CEO of Trace Finance, said the proceeds become harder to launder over time as funds are marked.
The theft is the latest in a series of major digital asset breaches; TRM Labs reported that attackers stole US$2.9 billion of cryptocurrency across nearly 150 incidents in 2025. Cryptocurrencies fell on Oct 30 and the total market value of stablecoins declined, suggesting investors pulled money from digital assets, according to Reuters.
According to TRM Labs, attackers compromised Binance's signing infrastructure, which authorises transactions, allowing them to issue instructions that emptied the affected wallets. Blockchain records show the bulk of the heist unfolded in about 20 minutes, beginning shortly after 2000 GMT on Oct 29. Once funds were moved, attackers raced to shift them beyond the reach of Binance counterparties and stablecoin issuers, which have frozen roughly half of the stolen assets. Joshua Chu, a Hong Kong lawyer who works on crypto cases, said the attacker may not have stolen the vault key but may have hijacked the system that tells the vault to release money.
Several US blockchain analysis firms said the attack bears similarities to previous operations attributed to North Korean hackers. Teng said Binance's investigation had not yet identified the attackers, and North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts. TRM said the breach shared characteristics with the 2025 attack on crypto exchange Bybit, which the FBI attributed to North Korean hackers, and that it was highly confident the same group was responsible. Chainalysis said funds stolen in a September attack on Bitget were being mixed with proceeds from the Binance breach.
About half the stolen assets were stablecoins frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, the Trump family's crypto venture. Freezing does not guarantee return of the coins to Binance, but it significantly limits the attackers' ability to convert them into cash. TRM estimated that about US$2.4 billion in bitcoin and ether is beyond reach, and said some funds had already been posted as collateral to borrow ether. Patrick Tan, general counsel of ChainArgos, noted that no company can freeze bitcoin or ether, which can be stopped only if sent to an exchange or broker willing to freeze them or if law enforcement obtains the private keys. Bernardo Brites, CEO of Trace Finance, said the proceeds become harder to launder over time as funds are marked.
The theft is the latest in a series of major digital asset breaches; TRM Labs reported that attackers stole US$2.9 billion of cryptocurrency across nearly 150 incidents in 2025. Cryptocurrencies fell on Oct 30 and the total market value of stablecoins declined, suggesting investors pulled money from digital assets, according to Reuters.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.