Binance has disclosed a security incident with an estimated impact of $6.3 billion, as blockchain investigators trace stolen cryptocurrency across multiple networks and examine links between the attack and Tornado Cash.
The exchange said on its initial investigation points to a potentially compromised laptop belonging to a DevOps engineer. The breach may have allowed an attacker to access an internal service and submit unauthorised withdrawal transactions.
Binance has not completed its investigation but said it would cover all losses using its Secure Asset Fund for Users (SAFU) and company funds. It also said user funds remain safe.
Blockchain intelligence firm TRM Labs estimates that approximately $6.36 billion in cryptocurrency was moved from Binance wallets across 10 blockchains on October 29. It attributes the attack with high confidence to TraderTraitor, a North Korean hacking group, based on its analysis of onchain and offchain evidence.
The incident has drawn attention to the role of cryptocurrency mixers and decentralised finance (DeFi) platforms in the movement of stolen assets. TRM Labs says small withdrawals from Tornado Cash helped fund a wallet involved in the operation, while subsequent activity included large token swaps and borrowing through DeFi lending protocols.
However, the evidence does not mean that all the stolen funds were transferred directly into Tornado Cash.
How the Binance security incident happened
According to TRM Labs, the attacker moved funds from Binance-linked wallets across several blockchain networks, including Ethereum, Bitcoin, Tron, Solana and XRP Ledger. Most of the transfers took place within approximately 20 minutes, beginning at 20:05 UTC on October 29.
TRM Labs said the attacker used a different mechanism on Ethereum, involving an EIP-7702 delegation that enabled a Binance hot wallet to act as a sweeper under the attacker’s control. The firm said the other affected networks saw ordinary signed transfers from Binance wallets.
The pattern led TRM Labs to assess that Binance’s hot-wallet signing infrastructure had been compromised. Binance’s own initial investigation, however, pointed to a possible compromise of an engineer’s laptop that may have given the attacker access to an internal service.
The exchange said it had found no evidence that wallet private keys had been leaked. Its investigation into the full attack path remains ongoing.
A hot wallet is a cryptocurrency wallet connected to systems that can process transactions online. Exchanges use hot wallets to facilitate withdrawals and other operations. Because they are connected to operational infrastructure, access controls and transaction-signing safeguards are important to protecting the assets they hold.
Binance temporarily suspended deposits and withdrawals while it carried out security checks and coordinated with blockchain partners. The company said deposits were unaffected and expected withdrawal services to resume within 48 hours of its October 30 update.
What Tornado Cash has to do with the stolen funds
Tornado Cash is a cryptocurrency-mixing protocol that uses cryptographic techniques to make it harder to link a deposit address with a withdrawal address.
On public blockchains, transactions can generally be inspected by anyone. Although wallet addresses do not automatically reveal their owners’ identities, investigators can analyse transaction histories and connections between addresses to trace funds.
Mixing protocols are designed to weaken that visible connection. They can support financial privacy, but they have also been used by attackers attempting to obscure the origins of stolen cryptocurrency.
In its analysis of the Binance incident, TRM Labs identified small withdrawals from Tornado Cash that funded an operator wallet associated with the attack. The firm also noted similarities with earlier thefts linked to North Korean hackers, including preparatory transactions and authorisations arranged before the main transfers.
A wallet receiving funds from Tornado Cash does not, by itself, establish who controls that wallet or prove the full path of stolen assets. Investigators combine transaction analysis with other intelligence to assess whether addresses are connected to a particular operation.
The Stolen assets moved through DeFi platforms
After the initial transfers, the attacker moved assets through additional services, according to TRM Labs.
The firm reported that the attacker sold USDT to market makers and borrowed Ether through Aave, using USDT as collateral. These transactions formed part of an effort to move value while blockchain companies and investigators attempted to freeze assets.
This creates a challenge for incident responders. Some stablecoins can be frozen by their issuers at designated blockchain addresses, while many decentralised protocols do not have the same centralised control over users’ funds.
The options available to investigators therefore depend on the assets involved, the networks being used and whether a service or issuer has the ability to intervene.
TRM Labs reported that Tether, Circle, Ripple and World Liberty Financial froze approximately $2.67 billion in stablecoins linked to the incident. Arbitrum’s Security Council also froze 8,426 ETH and 74.6 million ARB on its network, bringing the total amount frozen to approximately $2.7 billion in TRM’s assessment.
Binance separately reported that approximately $3 billion in affected assets had been frozen by the time of its October 30 update. The difference between the figures reflects the timing and scope of the respective reports.
Freezing assets does not necessarily mean that every amount has been recovered or returned to its rightful owner. It generally means the affected assets have been blocked from further movement through the relevant controls.
Binance says it will cover all losses
The exchange established SAFU as a reserve intended to protect users in emergencies, including security incidents. Binance also said it would publish an updated proof of reserves after completing remediation.
The company’s assurance that user funds remain safe is important for customers, but it should be distinguished from the ongoing investigation into the incident itself. Binance has not yet published a full technical post-mortem explaining exactly how the attacker gained access or how the unauthorised withdrawals were executed.
The exchange is working with law enforcement and blockchain intelligence partners to trace and recover assets. It has also revoked the affected address authorisation as part of its immediate response.
The incident has renewed questions about the security of centralised cryptocurrency exchanges, particularly the systems used to authorise transactions. A compromise involving an employee’s device or internal service can create risks even when there is no evidence that the underlying private keys have been directly exposed.
For exchanges, this makes layered controls important. These can include strong device security, restricted access to internal systems, transaction monitoring and safeguards that prevent a single compromised account or service from authorising large unauthorised transfers.
The Binance incident has exposed the difficulty of responding to a large cryptocurrency theft once funds begin moving across multiple networks and protocols.
Blockchain transactions provide investigators with a public record to analyse, but tracing funds is only one part of the process. Freezing or recovering assets may require cooperation from stablecoin issuers, blockchain governance bodies, exchanges, lending platforms and law enforcement agencies.
TRM Labs’ attribution to TraderTraitor is based on its assessment of the available intelligence. Binance has not publicly confirmed the identity of the attacker, and its investigation remains ongoing.
The incident also adds to a series of major cryptocurrency thefts. In February 2025, Bybit suffered a roughly $1.5 billion hack that the US Federal Bureau of Investigation attributed to North Korea-linked actors. TRM Labs said the Binance attack was around four times larger by its estimate.
For now, investigators are focused on tracing the remaining assets, identifying the attack path and determining whether more funds can be frozen. Binance says it will cover the losses, but a complete account of the incident will depend on the findings of its investigation and the work of its partners.
Read also: Nigerian Tech Founder Launches AI Startup to Train 1M Engineers