"This was a complex attack," the company said.
A record-breaking theft: $6.3bn taken, $3bn frozen
Global cryptocurrency exchange Binance confirmed on October 30 that it suffered what it called the largest cyber-attack in history, with $6.3 billion of cryptocurrency stolen. The company reported it has frozen roughly $3 billion of those stolen funds and that it will cover all customer losses using its Secure Asset Fund for Users (SAFU) and company funds. Binance has repeatedly stressed that customer funds remain safe even as the scale and details of the incident have emerged.
Initial forensic thread: a DevOps laptop — then more points of breach
Binance described an evolving investigation. Early findings suggested the attacker’s entry point may have been a compromised Binance development and operations (DevOps) engineer’s laptop, which allegedly allowed access to a service container and submission of unauthorized withdrawal transactions. The company later revised that assessment, saying subsequent investigation uncovered additional points of breach. Binance has not yet provided a definitive account and said it will publish a comprehensive technical post‑mortem once the investigation is complete. The company also said it has found no evidence that any wallet private keys were leaked.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOperational lockdown: deposits, withdrawals and trading controls
As part of its response, Binance implemented precautionary measures that included temporarily suspending all deposits and withdrawals and halting certain Binance Alpha trading activities — specifically CEX Buy Token, Alpha Instant and CEX purchase prediction marketing activities that used funds in users' spot wallets. In later updates Binance clarified that deposits have resumed normal operations and remain unaffected. Withdrawals, however, remained suspended at the time of the company’s statement while Binance completed a security revamp of its withdrawal service and related addresses, with resumption expected within 45 hours. Binance reported that unauthorised outflows ceased after withdrawals were paused and that it has revoked the affected address authorisation.
Attribution and partners: TraderTraitor named by three analysis firms
Three cryptocurrency analysis firms — TRM Labs, Elliptic and Chainalysis — attributed the attack with “high confidence” to TraderTraitor, a North Korean hacking group. Binance said it is working with law enforcement, blockchain intelligence firms, token issuers and other industry partners to establish the full circumstances and to identify and recover affected assets. The exchange also said it continues to trace and freeze affected assets in cooperation with those partners.
Customer guidance and proof-of-reserves commitment
Binance warned customers to remain alert to scams that might exploit the incident and specifically advised users not to trust unofficial links, messages or requests for account information. Customers were told to rely exclusively on Binance’s official communication channels for updates and to contact Binance Customer Support with questions. The company promised to publish an updated proof of reserves once remediation work is complete, providing customers with an updated view of the assets held against user balances.
What this means for technologists, law enforcement, and users
- Technologists and security teams: The company’s evolving forensic narrative — from a compromised DevOps laptop to “additional points of breach” — underscores the need to investigate supply‑chain and privileged‑access vectors and to harden controls around service containers and credentialed engineering workstations.
- Law enforcement and blockchain intelligence: With $3 billion frozen and multiple tracing partners engaged, investigators will have to work across on‑chain movement, token issuers and custodial interfaces to identify, isolate and recover assets while coordinating internationally.
- End users and customers: Although Binance pledged to cover losses with SAFU and company funds and to publish updated proof of reserves, users were specifically warned to watch for scams and to use only official Binance channels for updates and support.
The company has framed the incident as ongoing and complex: it has frozen a portion of the stolen currency, promised full customer coverage of losses, revised its initial technical account as new findings emerged, and pointed to a coordinated tracing and law‑enforcement effort that includes attribution by three leading blockchain analysis firms. Binance’s next concrete deliverables are an updated proof of reserves and a comprehensive technical post‑mortem; until those are published, key operational details — the full attack chain, the exact additional breach points, and the prospects for recovering the remaining roughly $3.3 billion — remain to be documented.
