Binance suffered a major security breach on October 29 after attackers moved approximately $6.36 billion in digital assets from exchange-controlled wallets across 10 blockchain networks, according to TRM Labs.
Most of the funds were transferred within roughly 20 minutes, TRM Labs estimated. A second wave of transactions reportedly followed several hours later.
Funds Moved Across Multiple Networks
The attackers moved billions of dollars through Binance-controlled wallets spanning multiple blockchain networks, including:
- Bitcoin
- Ethereum
- XRP Ledger
- Tron
- Solana
Blockchain analytics account Lookonchain said more than $5.8 billion was taken. It added that $1.58 billion in USDT and $823 million in USDC, a combined $2.41 billion, had been frozen.
The coordinated movement of funds across different blockchain networks raised concerns about the security of Binance’s internal wallet-signing infrastructure.
Compromised Engineer Laptop Suspected
Binance’s preliminary investigation suggests attackers gained access through a compromised laptop belonging to a DevOps engineer. The unauthorized access reportedly allowed them to reach an internal service container and submit unauthorized withdrawal transactions.
Binance said the incident involved a complex attack process rather than simply exploiting one employee’s permissions. The exchange also said it had found no evidence of leaked wallet private keys, although investigators identified additional breach points and continued examining the full attack path.
Exchange Response
Binance temporarily suspended withdrawals across several networks while investigating the breach. The exchange said it has coordinated with blockchain companies and law enforcement agencies to freeze affected assets and pledged to cover all customer losses.
