Posted by The Binance crypto theft, involving approximately US$6.36 billion in cryptocurrency, has once again raised concerns over the security of digital asset exchanges. The incident, which took place on 29 October, is being described by blockchain intelligence firm TRM Labs as the largest cryptocurrency theft in history. The attack has also drawn attention to the security of the systems exchanges use to manage wallets and authorise transactions.
How the Binance crypto theft unfolded
TRM Labs, a blockchain intelligence company, said in its analysis of the Binance crypto theft that the attacker moved approximately US$6.36 billion from Binance wallets across 10 blockchain networks. Most of the transfers took place within 20 minutes, indicating the speed and scale of the operation.
The company’s analysis points to a possible compromise of Binance’s hot-wallet signing infrastructure, which authorises transactions from wallets connected to the internet. On Ethereum, the attacker used a mechanism known as EIP-7702 to make a Binance hot wallet execute a smart contract that transferred funds to an address under the attacker’s control.
TRM Labs also said that transactions across the other nine blockchain networks carried valid signatures, suggesting that the attacker had gained the ability to authorise transfers across multiple networks. Binance has yet to conclude its internal investigation and disclose the specific cause of the incident.
The US Federal Bureau of Investigation (FBI) attributed the Binance crypto theft to North Korea, identifying the activity as part of a campaign linked to the TraderTraitor group. TRM Labs had also identified TraderTraitor as the group behind the theft. US authorities use the name TraderTraitor to identify cyber activity linked to North Korea, including espionage and financially motivated cyberattacks.
The FBI said the attackers were converting the stolen assets, primarily into Ether, the cryptocurrency of the Ethereum network. It urged cryptocurrency platforms and other virtual asset service providers to block transactions linked to identified addresses. However, the FBI’s attribution to North Korea does not establish where the attackers physically operated from, or whether they carried out the operation from within the country or elsewhere.
Binance restores withdrawals after crypto theft
While investigators and blockchain intelligence firm continued to track the stolen assets, Binance has focused on restoring services and ensuring that customers retained access to their funds. In its latest update on November 1, the cryptocurrency exchange said it had begun resuming withdrawals in phases after conducting security assessments and verifying the readiness of affected services.
Binance said it had replenished approximately 95% of the affected assets using company resources as of November 1. The exchange added that it was sourcing the remaining 5% through market purchases and over-the-counter channels. These remaining assets comprised tokens outside the top ten, which had lower market liquidity and took longer to acquire. It further said that balances in major cryptocurrencies, including Bitcoin, Ether, USDT, BNB and Solana, were fully backed by reserves.
Moreover, Binance said it was working with law enforcement agencies and industry partners to trace the stolen funds and support recovery efforts. The exchange also said it was strengthening its security reviews and monitoring for residual risks following the incident. It plans to publish a post-incident report after completing its internal investigation.
Binance crypto theft puts exchange security under scrutiny
The cryptocurrency theft has put core focus on the security aspects of internal systems, employee devices and overall exchange operation. In its initial observation, cybersecurity firm Kaspersky tweeted that Binance’s preliminary findings suggested a compromised DevOps laptop may have enabled access to internal systems.
However, the full attack chain remains unclear, and Binance has yet to disclose the findings of its internal investigation.
The Binance incident follows several major thefts involving cryptocurrency exchanges in recent years. In 2025, Bybit suffered a theft of approximately US$1.4 billion in digital assets, while WazirX reported a loss of around US$230 million in 2024.
For instance, the Bybit attack involved the compromise of a third-party wallet developer’s credentials, which allowed attackers to manipulate the transaction approval process. In the WazirX incident, the exchange’s preliminary findings pointed to a discrepancy between the transaction details displayed on a custody platform’s interface and the actual transaction being signed.
These incidents highlight the continuing security challenges faced by exchanges and digital platforms that handle large volumes of digital assets and operate around the clock.
The Binance crypto theft underlines the need for cryptocurrency exchanges to look beyond wallet security and strengthen the systems that control access to digital assets. This includes securing employee devices, restricting access to critical infrastructure, monitoring suspicious activity and strengthening transaction authorisation processes. A weakness in any of these areas could expose assets even when exchanges have other security measures in place.
Interestingly, cryptocurrencies have often been promoted as secure, transparent and traceable forms of digital assets. However, recent thefts involving major exchanges have exposed the security challenges that continue to affect the ecosystem.
The incident also underline a wider concern in the digital world: security teams and cybercriminal groups increasingly have access to sophisticated tools and technologies. The challenge for organisations is to stay ahead of attackers who continue to find ways to exploit weaknesses in systems and security mechanisms.