Cryptocurrency exchange Binance is investigating a major security breach involving approximately $6.3 billion in digital assets. Preliminary findings suggest that attackers may have gained access to the company’s internal infrastructure through a compromised employee laptop, enabling unauthorized cryptocurrency withdrawals.
The incident emerged on October 29, 2026, when blockchain researchers detected unusually large transfers from Binance-controlled wallets. The exchange initially described the situation as a potential security issue before providing further details about the suspected intrusion.
According to Binance, its investigation identified a compromised laptop belonging to a DevOps engineer as a possible entry point. The attackers may have used this access to reach an internal service container and submit unauthorized withdrawal transactions. However, the company later clarified that the attack involved additional points of compromise and could not have been completed using a single device.
Binance said investigators have found no evidence that cryptocurrency wallet private keys were leaked. The company has not yet established the complete sequence of events or publicly identified the attackers.
The exchange estimates the financial impact at approximately $6.3 billion, potentially making the incident the largest cryptocurrency theft recorded to date. Binance reported that it had worked with blockchain companies to freeze around $3 billion in affected assets.
Stablecoin issuers Tether and Circle were among the companies responding to the incident. Tether reported freezing more than $1.5 billion in USDT, while Circle blocked over $800 million in USDC associated with the suspicious transactions.
Binance temporarily restricted withdrawals while conducting security checks and revoked authorization associated with the affected address. The company subsequently clarified that deposits remained operational and that withdrawals would resume after the necessary security work.
The exchange has pledged to reimburse affected customers using its Secure Asset Fund for Users (SAFU) and company funds. It also plans to publish updated Proof of Reserves information after completing remediation.
Several blockchain security researchers have suggested that the attack may be connected to TraderTraitor, a North Korean-linked hacking group previously associated with major cryptocurrency thefts. However, Binance has not confirmed this attribution, and the investigation remains ongoing.
The company is cooperating with law enforcement and blockchain intelligence specialists to trace the remaining assets. Binance has also promised to release a detailed technical report once investigators have verified the circumstances of the breach.