Binance has reported a security breach with an estimated impact of $6.3 billion after an attacker moved cryptocurrency from wallets linked to the exchange across multiple blockchain networks. The incident triggered a sharp market sell-off, with more than $1.5 billion in leveraged crypto positions liquidated within 24 hours.
The breach occurred on October 29 and Blockchain intelligence firm, TRM Labs estimated that approximately $6.36 billion in cryptocurrency had been transferred from Binance wallets across 10 blockchain networks, making the incident the largest crypto theft on record by its estimate.
The market impact was also significant. Bitcoin fell below $77,000 during Thursday’s sell-off, while Ether, XRP and BNB recorded declines. Data reported by CoinGlass showed that crypto liquidations reached approximately $1.53 billion over 24 hours, as falling prices forced traders out of leveraged positions.
How the Binance hack happened
Binance’s initial investigation suggests that the attack may have involved a compromised laptop belonging to a DevOps engineer. According to the exchange, the attacker may have used the laptop to gain access to an internal service container and submit unauthorised withdrawal transactions.
Binance said it had found no evidence that wallet private keys were leaked. The exchange has not yet released a full technical report explaining precisely how the attacker gained access or how the unauthorised transactions were approved.
TRM Labs’ blockchain analysis indicates that the attacker moved funds from Binance-linked wallets across networks including Ethereum, Bitcoin, Tron, Solana and XRP Ledger. The transfers began on October 29, with a large portion of the activity occurring within approximately 20 minutes from 20:05 UTC.
On Ethereum, TRM Labs identified the use of an EIP-7702 delegation mechanism that allowed a Binance hot wallet to execute transactions under the attacker’s control. The firm said the other affected networks recorded signed transfers from Binance wallets.
The analysis suggests that the operation involved coordinated transactions across several networks rather than a single wallet being drained in one transfer. TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean hacking group, based on its analysis of on-chain and off-chain intelligence. Binance has not publicly confirmed the identity of the attacker.
$1.5 billion in crypto positions liquidated
The breach coincided with a sharp decline across the cryptocurrency market, contributing to heavy losses among traders using leverage.
According to CoinGlass data cited by CoinDesk on October 30, approximately $1.53 billion in crypto positions were liquidated over 24 hours. Long positions, which are bets that cryptocurrency prices will rise, accounted for about $1.29 billion, or 83.8% of the total.
Bitcoin positions accounted for approximately $499 million in liquidations, while Ether recorded about $358 million. Solana, XRP and Dogecoin also registered forced closures. Binance accounted for roughly $754.6 million of the reported liquidations across exchanges
Liquidations occur when traders borrow funds or use leverage to increase the size of their market positions. When prices move against them and their available collateral falls below the required level, exchanges can automatically close those positions.
The figures represent the value of traders’ positions forcibly closed across the crypto market. They are separate from the estimated $6.3 billion impact of the Binance security breach and should not be interpreted as additional funds stolen from the exchange.
Bitcoin fell to approximately $76,460 before recovering towards $78,500, while Ether traded below $2,200 during the sell-off before rebounding. These price movements reflected a volatile market as traders reacted to the breach and adjusted their positions.
Binance estimates impact at $6.3 billion
Binance placed the estimated total impact of the incident at approximately $6.3 billion. The exchange said it had worked with blockchain partners to freeze around $3 billion in affected assets.
TRM Labs separately estimated that approximately $2.7 billion had been frozen through stablecoin issuers and blockchain-level intervention. The figures differ slightly because the reports use different assessments and reporting cut-off times. Frozen assets have been blocked from further movement through the relevant controls, but freezing does not automatically mean that all the funds have been recovered.
Binance temporarily suspended deposits and withdrawals while it carried out security checks. The exchange said it would cover all losses using its Secure Asset Fund for Users (SAFU) and company funds, adding that user funds remained safe.
The company also said it was working with law enforcement agencies and blockchain intelligence partners to trace the funds and investigate the incident. A detailed technical post-mortem is expected after the investigation is complete and the facts have been verified.
The breach has placed Binance at the centre of one of the largest security incidents in cryptocurrency history. While the exchange’s initial findings point to a possible compromise of an employee’s device and internal service, the full technical details and the identity of the attacker remain unconfirmed by Binance.
For now, the reported figures show the scale of the incident: approximately $6.3 billion in affected cryptocurrency, around $3 billion in assets reported frozen by Binance, and $1.53 billion in market-wide liquidations during the 24-hour period. As Binance’s investigation continues, the exchange’s final account of how the attacker gained access and authorised the transactions remains pending.
Read also: Binance Hack: Investigators Trace Tornado Cash Links as $6.3B Is Stolen