Binance Hack Hits $6.3B, CZ Speaks Out, and North Korea Is Suspected

Key takeaways

• Binance suffered a $6.3 billion hack, with preliminary findings suggesting attackers compromised an employee's laptop
• North Korean hackers are suspected, with blockchain investigators linking the attack to the TraderTraitor
• CZ assured users their funds were safe

Binance is investigating a massive cryptocurrency hack involving approximately $6.3 billion in digital assets. Preliminary findings suggesting that attackers compromised an employee's laptop to gain access to the exchange's internal systems. Blockchain investigators have also linked the attack to a notorious North Korean hacking group.

The Oct. 29 incident could become the largest cryptocurrency theft in history, surpassing the $1.5 billion Bybit hack in Feb. 2025.

Binance Reveals How Hackers May Have Accessed Its Systems

In an Oct. 30 security update, Binance revealed that its initial investigation pointed to a compromised laptop belonging to a DevOps engineer.

The attacker allegedly used the device to access a service container and initiate unauthorized withdrawal transactions. However, Binance made it clear that investigators found no evidence of leaked wallet private keys.

The exchange estimated the incident's total impact at approximately $6.3 billion, although the final amount of unrecovered assets remains uncertain.

Binance and its blockchain partners have already frozen approximately $3 billion in affected assets. Stablecoin issuers Tether and Circle were among the companies that intervened to prevent the movement of potentially stolen funds. Binance also temporarily suspended deposits and withdrawals, revoked affected address authorizations, and contacted law enforcement.

North Korean Hackers Suspected as CZ Responds

Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, a North Korean hacking operation associated with previous major cryptocurrency thefts. According to TRM Labs, approximately $6.36 billion was transferred from Binance wallets across ten blockchains, with much of the activity occurring within roughly 20 minutes.

The researchers also identified the use of Ethereum's EIP-7702 functionality in the attack, which suggests a sophisticated operation involving compromised transaction-signing capabilities. However, Binance has not officially confirmed the attackers' identities.

Meanwhile, Binance founder Changpeng Zhao (CZ) addressed the incident on X by acknowledging that the suspicious activity appeared to be a hack. ”User funds are safe! It does look like a hack on Binance,” Zhao wrote. He also thanked Tether and Circle for freezing assets linked to the incident.

Although Zhao stepped down as Binance CEO in 2023, he said that, as a shareholder, he expected all affected users to be fully compensated.

Binance Promises to Cover Losses

Binance assured customers that their funds remained safe and pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and company resources. The exchange also promised to publish an updated Proof of Reserves after its security remediation efforts.

A detailed technical investigation is still underway, with Binance expected to release a comprehensive report once its findings have been verified.