17.09.2024
1 min
1118
Binance, the world’s largest cryptocurrency exchange, suffered a massive cyberattack in which approximately $6.3 billion in digital assets was stolen from its wallets. Researchers have linked the hack to North Korean hackers, who carried out most of the transactions in just 20 minutes.
In an official Binance statement, the exchange confirmed the security incident and announced that it was working with blockchain companies to freeze the stolen assets. As of October 30, approximately $3 billion had been frozen, while the whereabouts of the remaining $3.3 billion were unknown. Binance co-founder Yi He assured users that the company would cover all losses resulting from the attack and that customer funds remained safe. Withdrawals were temporarily suspended, with the affected services expected to resume within 48 hours.
According to preliminary findings from Binance’s internal investigation, the initial entry point may have been a compromised laptop belonging to one of the exchange’s DevOps engineers. Through the compromised device, the attackers may have gained access to a service container and initiated unauthorized transactions. However, the company found no evidence that cryptocurrency wallet private keys had been exposed. The exact cause of the compromise has yet to be established, and Binance has promised to publish a detailed technical report once the investigation is complete.
“The incident resulted from several factors. Our security team is tracing the full attack chain through the compromised computer, which may have served as the initial entry point,” Binance stated.
Researchers at TRM Labs and Chainalysis have linked the hack to North Korea with high confidence. According to their findings, preparations for the theft began at least 36 hours before the attack. The hackers prepared their infrastructure in advance and gained the ability to execute transactions from Binance hot wallets across multiple blockchains. Most of the assets were transferred in approximately 20 minutes.
Researchers paid particular attention to the attack on an Ethereum hot wallet. The hackers exploited EIP-7702, a mechanism that allows a standard cryptocurrency wallet to delegate transaction execution to a smart contract. By preparing 50 signed authorizations, the attackers were able to control the wallet through their own contract and transfer funds from it. One transaction enabled them to withdraw 167,464 ETH and 63 other types of tokens, including 1.615 billion USDT. The attackers subsequently continued draining assets that arrived at the compromised address.
Meanwhile, Binance wallets on other networks, including Bitcoin, Tron, Solana, and XRP Ledger, executed regular signed transactions to attacker-controlled addresses. According to analysts, this may indicate that the exchange’s transaction-signing infrastructure was compromised, although no definitive conclusions about the attack mechanism have been reached.
The attackers used similar methods during the February 2025 hack of cryptocurrency exchange Bybit, when approximately $1.5 billion was stolen. At the time, the FBI officially attributed the theft to the North Korean hacking group TraderTraitor.
“We make this assessment with a high degree of confidence,” TRM Labs stated, commenting on TraderTraitor’s involvement in the Binance attack.
North Korea’s representatives in Geneva and its embassy in China did not respond to Reuters’ requests for comment. Meanwhile, analysts continue tracking the movement of stolen funds to determine the full scale of the operation and the attackers’ subsequent activities.
Several major cryptocurrency companies joined efforts to freeze the stolen assets. According to TRM Labs, stablecoin issuers Tether, Circle, Ripple, and World Liberty Financial collectively froze approximately $2.67 billion. Tether blocked the largest share, around $1.77 billion in USDT, while Circle froze approximately $825 million in USDC. Ripple froze 40.5 million RLUSD, and World Liberty Financial, a cryptocurrency company linked to the family of US President Donald Trump, froze approximately $27.8 million in USD1. In addition, the Arbitrum Security Council blocked 8,426 ETH and 74.6 million ARB, worth a combined total of approximately $30 million.
Despite these measures, the attackers managed to convert some of the stolen assets into cryptocurrencies that cannot be directly frozen by their issuers. According to researchers’ estimates, more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion combined, remained under the attackers’ control.
News of the attack triggered declines in cryptocurrency prices and shares of companies associated with digital assets. During Asian trading on Friday, Bitcoin fell more than 3% to a six-week low of $76,368. Ethereum also lost over 3%, dropping to $2,178, its lowest level in two months. BNB, the native token of the Binance ecosystem, declined 5% over 24 hours to $709.70, according to CoinGecko.
In the stock market, shares of cryptocurrency exchange Coinbase Global fell 4.8%, while shares of Strategy, a company known for its substantial Bitcoin investments, dropped nearly 6% during extended US trading hours. Analysts noted that the incident could further undermine investor confidence in cryptocurrencies, which were already under pressure from high US interest rates and declining demand among exchange-traded fund investors.
“This could further weaken investors’ risk appetite and prompt them to reassess the security of assets held on centralized exchanges, as well as counterparty, solvency, and liquidity risks,” said Tim Sun, senior researcher at HashKey Group.
The scale of the incident is particularly significant given Binance’s size. The exchange has approximately 335 million registered users worldwide and held around $162.8 billion in assets under custody as of the end of 2025. The company also maintains the Secure Asset Fund for Users (SAFU), established in 2018 to protect customer assets in the event of major security incidents. As of February 2026, the fund held approximately $1 billion.
Trace Finance CEO Bernardo Brites believes that advances in artificial intelligence are making cryptocurrency infrastructure increasingly difficult to protect, as new vulnerabilities may be discovered faster than companies can address them. In his view, major attacks of this scale could drive users away from small and medium-sized exchanges that lack sufficient reserves to compensate for substantial losses.
According to the TRM Labs 2026 Crypto Crime Report, attackers stole approximately $2.87 billion in digital assets across nearly 150 attacks in 2025. The largest losses resulted from the Bybit hack, which accounted for more than half of the total amount stolen that year. In September 2026, cryptocurrency exchange Bitget also reported losing approximately $350 million in a hack. Law enforcement agencies have repeatedly warned that organized criminal groups are increasingly using cryptocurrencies to move funds internationally outside the traditional financial system.
Miguel Morel, CEO of blockchain analytics company Arkham, also confirmed that blockchain data indicated billions of dollars had been withdrawn from Binance by an unidentified attacker. Meanwhile, Binance.US, the exchange’s separate American platform, stated that it had not been affected by the attack. Coinbase likewise reported that its infrastructure remained unaffected and that it was continuing to monitor the situation.
On the same day, another cryptocurrency platform, Polymarket, temporarily suspended trading following the compromise of a third-party service provider. The company later resumed operations and promised to fully compensate affected traders. The incident has not been directly linked to the Binance hack.
The investigation into the Binance attack is ongoing. The exchange is working to recover or freeze the stolen assets and has promised to cover the losses, although a significant portion of the funds remains beyond its control.
