Binance disclosed on 29 October a security incident affecting about $6.3 billion in user funds, probably the largest crypto theft on record. TRM Labs attributes the attack with high confidence to North Korea's TraderTraitor group, which moved about $6.36 billion across ten blockchains, mostly within 20 minutes. According to Binance, its initial investigation points to access through a compromised laptop belonging to a DevOps engineer, and the exchange has pledged to cover all losses. Tether froze more than 1.5 billion USDT, Circle more than 800 million USDC and Ripple about 200 million RLUSD.

What it means: The size of the theft far exceeds the previous record, the $1.5 billion taken from Bybit in February 2025, and confirms that North Korean groups now target the people and tools that run systems, not only the wallets themselves. One compromised laptop with access to infrastructure was enough to move billions within minutes. Binance's pledge to cover losses protects customers, but the halt in withdrawals shows the core risk of centralised platforms: as long as funds sit on an exchange, users depend on its security controls. The freezing of billions in stablecoins by their issuers shows these instruments can be controlled centrally, which helps recovery but is a reminder that they are not independent of the issuer. For European businesses holding funds in crypto, spreading them across several MiCA-licensed providers, using self-custody where feasible and having a plan for a withdrawal freeze are now basic measures. For regulators, the incident will reinforce DORA requirements on access management and staff devices. Crypto prices fell sharply after the news.

Read the original on TRM Labs

Related service: Consulting

Related stories