On October 30, Binance reported a hack. According to the company, the damage is estimated at approximately $6.3 billion. This is the largest cryptocurrency theft in history, notes Reuters. The FBI has accused hackers from North Korea.

The cryptocurrency exchange believes that unknown individuals hacked into the laptop of one of Binance's DevOps engineers. "This allowed the attacker to gain access to the service container and send unauthorized transactions to withdraw funds. We have not found any evidence of a leak of closed wallet keys," the company said in a statement.

"We believe that the consequences of the Binance incident may go far beyond the immediate loss of assets. This incident may be one of the largest security breaches in the history of the cryptocurrency industry," commented Tim San, a senior researcher at HashKey Group.

A number of experts have already suggested that the theft was likely carried out by hackers from North Korea. Specialists from TRM Labs suspect that the attackers targeted Binance wallets in ten blockchain networks and transferred most of the funds in about 20 minutes.

Recall that the previous largest hack related to cryptocurrencies occurred in February 2025, when hackers stole approximately $1.5 billion from the Bybit exchange. North Korean hackers are also suspected of being involved in that attack.

The FBI stated that North Korea is responsible for the hack and theft of over $6 billion in virtual assets from the Binance cryptocurrency exchange. It is alleged that the attackers were seen laundering the stolen assets by converting them into Ethereum.

"It is expected that these funds will then be laundered further by converting them using decentralized finance services and instant cryptocurrency exchange," the FBI said in a press release.

Meanwhile, Binance announced that it has already compensated 90% of the stolen funds to its clients from its own assets.

"The financial consequences of the theft will be borne by Binance, not our users," the exchange said in a publication.

Updated

Binance clients withdrew $3.64 billion (or 2.1% of the total assets) after the cryptocurrency exchange resumed operations on Sunday. Binance also reports that after the initial surge, withdrawal activity has stabilized, and deposit volumes remain "significant".

Earlier, Binance stated that the resumption of the possibility of withdrawing funds would occur in stages, taking into account user requests. In the first stage, owners of 15 types of tokens gained access to withdrawals, including bitcoin (BTC), ether (ETH), stablecoins USDC and USDT, as well as Dogecoin (DOGE).

Updated 03.11.2026

On Tuesday, Binance explained how, apparently, the hacking of its IT infrastructure occurred, which led to the unfortunate consequences. The company's report notes that the preparation of the hacking operation likely took "months" and involved various methods of penetration and information gathering to compromise the cryptocurrency exchange's system: fake job interviews, specially developed software with malicious content mimicking legitimate development tools, devices with vulnerabilities, and various AI techniques.

After the preparatory stage, the implementation of the plan began, and the entry point was a Binance employee. In particular, one of the exchange's engineers was contacted by an alleged employer through a real internet platform for personnel selection. The communication continued, apparently, in a third-party chat, and the attacker introduced himself as the head of a fake company, offering the Binance employee to download software to complete a test task, which contained malicious code, according to Bloomberg. It was used to launch a chain of unauthorized actions.

Also, through the computer of this employee, hackers were able to access the laptops of two other programmers working on Binance's digital wallets. The software containing the malicious payload was presented as an "advanced AI coding tool".

Apparently, according to the news initially released by Binance, the exchange initially assumed that only one laptop had been compromised, but the company later clarified that the attack was multi-stage and complex.