The world’s largest cryptocurrency exchange, Binance, has suffered a $6.3 billion cyberattack described by security experts as potentially the largest theft in history, with investigators identifying North Korean state-backed hackers as the likely perpetrators.
![](https://thenigerialawyer.com/wp-content/uploads/2026/09/2026-IDRI-Masterclass.png")
The attack, which occurred late on Thursday, October 29, 2026, triggered an international effort to trace, freeze and recover the stolen digital assets, while Binance assured its customers that it would cover all losses arising from the security breach.
Blockchain intelligence firms Elliptic, TRM Labs and Chainalysis linked the attack to North Korean hackers, with TRM attributing it with high confidence to TraderTraitor, a hacking group associated with the North Korean state.
The findings remain assessments by cybersecurity researchers, rather than a final determination by law enforcement authorities.
The scale of the theft has raised fresh concerns about the security of cryptocurrency exchanges, particularly as the stolen amount far exceeds the $1.5 billion taken from a Dubai-based cryptocurrency exchange in 2025.
Tom Robinson, chief scientist at cryptocurrency consultancy Elliptic, described the incident as unprecedented.
“This is almost certainly the largest theft of any kind in history,” Robinson said.
The $6.3 billion loss also exceeds the approximately $1 billion taken from Iraq’s central bank by Saddam Hussein in 2003.
According to Binance, preliminary investigations suggested that the breach may have originated from a compromised laptop belonging to one of its engineers.
The attackers allegedly used the compromised device to gain access to an internal system and initiate unauthorised withdrawals.
However, Binance subsequently disclosed that investigators had identified additional points of compromise, suggesting that the operation involved a more sophisticated attack than initially understood.
Blockchain analysts also identified unusual laundering patterns as the attackers attempted to move the stolen assets through cryptocurrency networks.
Binance, which enables customers to buy, sell and trade digital assets, has approximately 335 million registered users worldwide and held about $162.8 billion in assets under custody, according to its 2025 annual report.
Following the attack, the exchange temporarily suspended deposits and withdrawals while its security teams investigated the breach, secured affected systems and worked with law enforcement agencies and other cryptocurrency companies to recover the funds.
In a statement, the company said, “As a precaution, all deposits and withdrawals are temporarily suspended while our security teams conduct checks, secure wallet infrastructure and trace affected assets, with the close support of our law enforcement and industry partners.”
Binance co-chief executive Richard Teng assured customers that their assets would be protected, announcing that the company had set aside $6.34 billion to cover the stolen funds.
“Bottom line – your money is safe, and we’re covering every loss,” Teng said.
The exchange also disclosed that approximately $3 billion in affected assets had been located or frozen as recovery efforts continued.
In a separate statement posted on X, Binance said it was working “to trace, freeze and recover additional funds.”
“We will weather this storm. Thank you for the support,” the company added.
Changpeng Zhao, the founder of Binance, also responded to the incident, reassuring customers that the company would take responsibility for the losses.
“User funds are safe!” Zhao wrote on X, while acknowledging that the incident “does look like a hack.”
Although he no longer manages Binance, Zhao said that “as a shareholder, I expect all user funds will be fully covered.”
Zhao, a Chinese-born entrepreneur who holds Canadian and United Arab Emirates citizenship, founded Binance and previously served as its chief executive.
He was sentenced to four months in prison in 2024 after pleading guilty to violations of United States anti-money-laundering laws. He subsequently received a presidential pardon from Donald Trump in 2025.
The cyberattack also triggered an immediate reaction in global cryptocurrency markets.
During early Asian trading on Friday, Bitcoin, the world’s largest cryptocurrency by market value, fell approximately five per cent from its level before news of the breach emerged.
The cryptocurrency declined to about $77,380, its lowest level in six weeks, as investors reacted to the scale of the attack and concerns about the security of assets held by centralised exchanges.
Tim Sun, a senior researcher at Hong Kong-based HashKey Group, warned that the incident could further weaken investor confidence in cryptocurrency platforms.
“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges,” Sun said.
The attack occurred at a time when cryptocurrency markets were already facing pressure from higher United States interest rates and weaker demand from buyers of cryptocurrency exchange-traded funds.
North Korea has increasingly been linked to major cryptocurrency thefts, which international investigators believe provide a means of obtaining funds despite economic sanctions imposed on the country.
The United States Federal Bureau of Investigation previously attributed the $1.5 billion cryptocurrency theft from a Dubai-based exchange in 2025 to North Korean hackers.
According to Elliptic, North Korean-linked hackers have stolen more than $6.5 billion in cryptocurrency assets in recent years, including more than $1 billion during 2026 before the latest incident.
The Binance attack has prompted cooperation among cryptocurrency companies, blockchain investigators and international law enforcement agencies, including the FBI and the United States Secret Service.
Stablecoin issuer Tether disclosed that it had frozen nearly $1.57 billion in assets linked to the incident, while Circle, another major stablecoin issuer, froze more than $800 million.
Stablecoins are digital assets designed to maintain a relatively stable value by being linked to conventional currencies, including the United States dollar.
Elliptic estimated that approximately $3.8 billion of the stolen assets involved Ethereum, making it the cryptocurrency most heavily affected by the breach.
World Liberty Financial, a cryptocurrency company linked to President Trump and his family, also disclosed that it had worked with digital asset custodian BitGo to freeze funds connected to the attack.
The incident adds to growing concerns about the vulnerability of cryptocurrency platforms to sophisticated cybercriminal operations.
According to TRM Labs, attackers stole approximately $2.9 billion in cryptocurrency across nearly 150 incidents in 2025.
In September 2026, cryptocurrency exchange Bitget disclosed that approximately $350 million in digital assets had been stolen from its platform.
Authorities have warned that organised criminal groups increasingly exploit cryptocurrencies to transfer illicit funds across borders, often outside conventional banking channels.
Meanwhile, Binance.US, which operates as a separate cryptocurrency exchange, said it was not affected by the security breach.
Coinbase, another major cryptocurrency trading platform, also confirmed that its operations were unaffected and that it was monitoring developments.
In the United Kingdom, financial regulators began monitoring the incident to determine whether it could affect banks, insurance companies and financial technology businesses with exposure to Binance.
The Financial Conduct Authority (FCA) confirmed that it was engaging with the exchange to assess the potential implications.
“While Binance wasn’t registered with the FCA to provide crypto services in the UK, we’re aware of the reported incident and engaging with them to understand the impact,” an FCA spokesperson said.
The Bank of England was also monitoring developments, although there were no immediate indications of wider financial stability concerns.
The Bank declined to comment publicly.
In a separate security incident on Thursday, prediction market operator Polymarket temporarily suspended trading following a breach involving a third-party service provider.
The company subsequently resumed trading and promised to reimburse affected customers.
[A MUST HAVE] Evidence Act Demystified With Recent And Contemporary Cases And Materials
Available now for NGN 40,000 at ASC Publications, 10, Boyle Street, Onikan, Lagos. Beside High Court, TBS. Email publications@ayindesanni.com or WhatsApp +2347056667384. Purchase Link: https://paystack.com/buy/evidence-act-complete-annotation
______________________________________________________________________ “Enhance Legal Practice With Authoritative Reports” — Alexander Payne Offers Comprehensive Law Reports, Spanning Over A Century Of Nigerian Jurisprudence
Interested buyers are encouraged to place their orders and enquiries via:
0704 444 4777, 0704 444 4999, 0818 199 9888
Website: www.alexandernigeria.com
