Binance spent much of Friday trying to secure money taken during a cyberattack the previous day. The cryptocurrency exchange was missing approximately $6.3 billion after an unauthorized series of transfers Thursday, October 29. Some of the money has since been located and blocked from further movement, but investigators are still trying to determine exactly how the theft happened.
The company says it has enough money to replace what was stolen. It has allocated about $6.34 billion from its own resources and maintains that customers will not have to absorb the losses. For people using the exchange, the more immediate problem was being unable to withdraw cryptocurrency while security checks were underway.
There was some progress in tracking the missing assets Friday. Early estimates put the amount frozen at roughly $3 billion. Binance later raised that number to around $5 billion as other cryptocurrency companies joined the effort. Freezing the money is one thing, though. Getting it back is another.
The transfers themselves happened quickly. Blockchain researchers examining the activity found that cryptocurrency had been moved through 10 separate networks, with most of the theft occurring during a period of approximately 20 minutes.
Binance initially believed that someone had gained access through a compromised laptop. That explanation did not account for everything investigators discovered. Additional security problems were identified, including interference with the procedures normally used to authorize movements of cryptocurrency.
Richard Teng, one of the exchange’s chief executives, said the operation also involved software that removed evidence of what the attackers were doing. Investigators have not found proof that the private access keys protecting the company’s wallets were stolen.
The question of who was responsible has brought renewed attention to North Korea. TRM Labs, a company that studies blockchain transactions, believes the attack was carried out by TraderTraitor, a group associated with the North Korean government. Another research company, Chainalysis, has reached a similar assessment.
Binance has not identified the people responsible. Its investigation is continuing with assistance from law enforcement agencies, including the FBI and Secret Service.
There is a reason investigators are looking closely at TraderTraitor. The group was previously connected to a February 2025 attack against Bybit, another cryptocurrency trading platform. That incident involved the disappearance of approximately $1.5 billion, and American authorities blamed North Korea.
Several companies that issue cryptocurrency have helped stop some of the latest stolen funds from moving. Tether restricted access to nearly $1.57 billion, while Circle took similar action involving more than $800 million. Researchers believe some of the remaining Bitcoin and Ethereum may never be retrieved.
Cryptocurrency prices also moved lower as traders reacted to the news. Bitcoin briefly traded near $76,000, while Ethereum fell to around $2,178. Binance’s BNB token declined as well.
The exchange has hundreds of millions of registered users and reported holding more than $162 billion in assets during 2025. Its regulator in Abu Dhabi is following the investigation and has been in contact with the company.
This image is the property of The New Dispatch LLC and is not licenseable for external use without explicit written permission.
