Global cryptocurrency exchange Binance is investigating a major security incident estimated to have affected approximately $6.3 billion in digital assets, in what could become one of the largest cryptocurrency thefts ever recorded.
The exchange disclosed the incident on Friday, October 30, 2026, saying preliminary investigations suggest that attackers may have gained access to its systems through a compromised laptop belonging to a DevOps engineer.
According to Binance, the suspected breach allowed an attacker to access a service container and submit unauthorised withdrawal transactions.
The company said it had found no evidence that wallet private keys were exposed but confirmed that investigations were continuing to establish exactly how the attack happened.
In an official security update, Binance estimated the total impact at approximately $6.3 billion. The exchange said it had worked with blockchain partners to freeze about $3 billion of the affected assets on-chain, while efforts to trace and recover the remaining funds continued. Binance also assured customers that their funds were safe, promising to cover all losses through its Secure Asset Fund for Users (SAFU) and company funds.
The SAFU fund was established to provide an additional layer of protection for users in emergencies involving the exchange. The company said it would publish a detailed technical report after completing its investigation and an updated proof of reserves once the remediation process had been completed.
Following the discovery of the incident, Binance temporarily suspended deposits and withdrawals as a precaution while its security team reviewed the affected systems.
The exchange later said deposits were operating normally, while withdrawals remained paused as it completed security upgrades and checks.
It also revoked authorisation for the affected address and engaged law enforcement agencies and blockchain intelligence firms to track the funds and identify those responsible.
The incident has attracted attention across the cryptocurrency industry, particularly because of the scale of the estimated losses and the possibility that the attackers exploited weaknesses in internal operational systems rather than directly exposing wallet private keys.
Blockchain intelligence firms have also linked the suspected attack to TraderTraitor, a hacking group associated with North Korea. However, Binance has not independently confirmed the identity of the attackers.
The incident has renewed concerns about the security of centralised cryptocurrency exchanges, where billions of dollars in digital assets are held and transferred on behalf of customers.
Market reports indicated that Bitcoin and other major cryptocurrencies experienced price declines following news of the breach, as investors assessed the potential implications.
For Binance, the immediate priorities are recovering affected assets, strengthening its security systems and maintaining customer confidence.
Although the exchange has promised to absorb the losses, the full technical details and final recovery figures remain subject to ongoing investigations.
The incident serves as another reminder of the security risks facing the global cryptocurrency industry and the importance of strong safeguards around digital asset platforms.