Binance Loses KSh819 Billion in Largest Crypto Heist

Binance, the world’s largest cryptocurrency exchange, has confirmed a security breach involving an estimated US$6.3 billion (KSh819 billion) in digital assets, suspending withdrawals and temporarily halting deposits as it investigates how attackers gained access to its systems.

According to Binance, an initial investigation points to a compromised laptop belonging to a DevOps engineer, which may have allowed an attacker to access a service container and submit unauthorised withdrawal transactions. The exchange said it found no evidence that wallet private keys were exposed, suggesting the incident involved unauthorised access to operational systems rather than a direct compromise of the cryptographic keys controlling its wallets.

The company has so far frozen approximately US$3 billion of the affected assets on-chain through cooperation with blockchain partners, leaving an estimated US$3.3 billion still unaccounted for. Binance said it would absorb all losses using its Secure Asset Fund for Users (SAFU) and company resources, maintaining that customer funds remain safe.

Blockchain intelligence firm TRM has attributed the attack to TraderTraitor, North Korea’s elite hacking unit, with high confidence. TRM’s on-chain analysis shows the attacker compromised Binance’s hot wallet signing infrastructure, moving funds from wallets across ten blockchains, including Bitcoin, Ethereum, Tron and Solana within a 20-minute window on October 29.

Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial, alongside Arbitrum’s Security Council, froze roughly US$2.7 billion. Despite this, the attacker raced the freezes by selling USDT at steep discounts and borrowing ETH against it on Aave. TRM estimates the attacker now controls about US$2.4 billion beyond any issuer’s reach, including over 420,000 ETH and 18,270 BTC.

Binance has restored deposits but kept withdrawals suspended while it overhauls its withdrawal service security, expecting to resume within 48 hours. It also temporarily suspended trading on Binance Alpha and pledged to release an updated proof of reserves after remediation.