AI-generated illustration

Binance has put the total cost of last week's cyberattack at $6.3 billion, while about $3 billion in digital assets has been frozen as investigations into the identity of the attackers and the fate of the transferred funds continue.

The world's largest cryptocurrency exchange said deposits and withdrawals were suspended temporarily and that all losses would be covered from its own funds and its user security fund.

Breach emerged on 29 October

Binance disclosed the security breach in a statement on 30 October, saying the incident had come to light the previous day. The company estimated the total cost at $6.3 billion and said roughly $3 billion in digital assets had been frozen so far. Deposits and withdrawals were halted temporarily while the exchange worked to contain the damage.

TRM Labs, a US-based blockchain analysis firm, calculated the value of the unauthorised transfers carried out across 10 different cryptocurrency networks at $6.36 billion. Binance said a final loss figure has not been determined, as work continues to recover the frozen assets.

Most transfers completed in about 20 minutes

TRM Labs found that the bulk of the transfers across networks including bitcoin and ethereum were completed in roughly 20 minutes. About $3.79 billion in digital assets was moved on the ethereum network, $1.47 billion on bitcoin and $628 million on tron.

Binance's initial review suggested the attack may have started when the computer of an engineer responsible for the company's software infrastructure was compromised. The attackers then used that access to carry out unauthorised withdrawals from company systems.

Cryptocurrency exchanges hold assets in internet-connected "hot wallets" to execute transactions quickly, and transfers from those wallets are run through the company's authorisation systems. Binance said it found no evidence that the secret data known as "private keys", which control the wallets, had been leaked. TRM Labs said the attackers may have exploited authorisations that had been prepared in advance.

The precise method used to gain access to the systems has not been established. Binance said it would publish a detailed report explaining the technical causes of the breach.

Binance raised the amount of frozen assets from the $2.54 billion it reported initially to about $3 billion. Companies that issue dollar-pegged cryptocurrencies, including USDT and USDC, also acted to block transactions at addresses linked to the attack. Tether, the issuer of USDT, and Circle, which issues USDC, can halt transfers of digital assets held at suspicious addresses.

Recovery work continues, but no comparable mechanism exists for cryptocurrencies such as bitcoin that have no central issuer. TRM Labs put the value of 18,270 bitcoin and more than 420,000 ethereum under the attackers' control at about $2.4 billion.

Binance said losses from the breach would be covered by its own resources and the "SAFU" fund it set up in 2018. Bitcoin and other cryptocurrencies fell in price after reports of the attack, while Binance TR said user assets in Turkey were safe and services were running without interruption.

Aleksandr Nam, head of the Centre for Research on Decentralised Finance and Digital Financial Assets at Russia's Higher School of Economics, told the AA news agency that large exchanges hold the assets of millions of users in one place. "The attack on Binance itself should not be surprising. During 2025-2026 the number and scale of attacks on the cryptocurrency sector rose sharply. In the first half of 2026 alone, more than $1 billion in assets was stolen as a result of systems being taken over and security vulnerabilities being exploited," Nam said.

Attacks do not always stem from blockchain technology being broken, Nam said, adding: "Vulnerabilities mostly appear in operational and information technology infrastructure." Nam listed the takeover of employee accounts or devices, social engineering, phishing, access to wallet management systems and gaps in permission controls among the main risks.

Nam stressed the importance of protecting hot wallets. For large platforms, "segmenting infrastructure, requiring multiple parties to approve critical transactions, applying limits, monitoring unusual activity, keeping most reserves offline and constantly testing incident response scenarios are critical", Nam said.

On the market impact, Nam said the breach was "a serious blow not only to Binance's reputation but to trust in all centralised cryptocurrency exchanges and the sector as a whole. Investors are again seeing that concentrating large amounts of liquidity in a single place creates systemic risk." Nam also said decentralised finance platforms face similar risks, citing the theft of about $285 million from Drift Protocol and $292 million from KelpDAO in April 2026.

As large cryptocurrency exchanges carry more weight in the financial system, they may face more comprehensive reviews, Nam said. "The response from regulators will likely be to strengthen requirements on cyber resilience, custody of customer funds, segregation of assets, reserves, independent audits, management of access permissions and disclosure of security incidents," Nam said.

Nam backed the freezing of assets linked to the attack. "Freezing assets connected to the attack is a necessary and correct measure. It buys time to stop unauthorised withdrawals and increases the chance that users' money will be recovered," Nam said. Stablecoins rely on reserves in the traditional financial system, Nam said, and issuing companies must have mechanisms to block addresses under anti-money laundering and sanctions compliance rules.

"The crypto world has not been fully decentralised for a long time. The contradiction lies in our old misconception that crypto is an area completely independent of the control of states and companies. The network itself may be decentralised, but a token, bridge, wallet, interface or stablecoin is almost always under the control of a particular person or organisation," Nam said.

North Korea link alleged but unverified

In research published on 29 October, TRM Labs attributed the attack to the North Korea-linked "TraderTraitor" group, saying the methods used resembled those seen in previous attacks blamed on the group. The identity of the attackers has not been confirmed by official authorities.

The US Federal Bureau of Investigation held North Korea responsible for the theft of about $1.5 billion in digital assets from the Bybit exchange in February 2025 and linked that attack to the same group. Binance said it would share a report containing the technical details of the attack and updated reserve information once the review is complete.

Key takeaways

• Binance put the total cost of the cyberattack at $6.3 billion, with about $3 billion in digital assets frozen.
• TRM Labs valued the unauthorised transfers across 10 networks at $6.36 billion, most of them completed in about 20 minutes.
• Binance's initial review points to a compromised engineer's computer as a possible entry point; no leaked private keys were found.
• TRM Labs linked the attack to the North Korea-affiliated "TraderTraitor" group, but authorities have not confirmed the attackers' identity.