The US Secret Service has confirmed it is working with partners to help track the roughly $6.3 billion in cryptocurrency stolen from Binance in what multiple blockchain analytics firms describe as the largest digital asset theft in history.
Binance, the world's largest cryptocurrency exchange by trading volume, disclosed the incident late on October 29, 2026, after attackers drained hot wallets across at least ten blockchains in a matter of minutes. The exchange has suspended withdrawals while it investigates and has committed to covering all losses using its secure asset fund for users and additional company resources.
Scale of the Theft and Immediate Response
Blockchain records analyzed by firms including TRM Labs, Elliptic, and Chainalysis show that approximately $6.3 billion worth of assets were moved from Binance-controlled wallets beginning around 20:00 GMT on October 29. The bulk of the transfers occurred in roughly 20 minutes, though activity continued across additional chains such as Avalanche and Polygon. The stolen holdings included large quantities of Bitcoin, Ether, USDT, USDC, and other tokens.
Stablecoin issuers including Tether and Circle quickly froze portions of the assets, contributing to roughly $3 billion in recoveries or freezes reported so far. Binance co-CEO Richard Teng stated that customer funds remain safe and that the platform has reserved more than $6.34 billion in company assets to cover the incident, with $5 billion already held in the affected tokens.
Reuters reported that the exchange initially attributed the breach to a compromised DevOps engineer's laptop but later identified additional points of compromise in its signing infrastructure. No evidence of private key leakage has been found.
Attribution to North Korean Actors
TRM Labs assessed with high confidence that the attack was carried out by TraderTraitor, a North Korean hacking unit also linked to the Lazarus Group. Chainalysis reached a similar conclusion after observing stolen funds commingling with proceeds from a prior exploit at Bitget. The pattern mirrors the February 2025 Bybit hack, which the FBI attributed to the same actors and which netted approximately $1.5 billion.
North Korea has a documented history of using cyber operations to generate revenue and evade international sanctions. Analysts note that this single incident could nearly double the regime's cumulative crypto thefts to date. Binance has stated it is cooperating closely with law enforcement to identify those responsible but has not publicly confirmed the North Korea connection.
Law Enforcement Involvement, Including US Secret Service
The BBC reported that the US Secret Service is actively assisting in tracking the stolen funds, describing the effort as round-the-clock work with multiple partners. Binance has also engaged the FBI and other agencies. This involvement underscores the cross-border nature of the investigation and the growing role of specialized US units in crypto-related crime.
BBC coverage highlighted that Binance believes more than one individual was involved in the complex operation. The exchange has begun recovering some funds and expects to resume withdrawals within approximately 45 hours once security enhancements are complete.
Market and Industry Context
Cryptocurrency prices declined following the news, reflecting concerns about exchange security at a time when institutional adoption continues to grow. The theft dwarfs previous incidents, including the 2025 Bybit breach, and raises questions about the resilience of even the largest platforms' infrastructure.
Binance maintains a secure asset fund for users, commonly referred to as SAFU, which was designed precisely for such events. The company has emphasized that deposits remain unaffected and that it is publishing updated proof-of-reserves information after remediation.
Blockchain intelligence providers such as Elliptic have verified billions in frozen assets while noting that attackers have begun swapping remaining holdings into non-freezable tokens like Ether and moving funds across chains to complicate recovery.
Broader Implications for Crypto Security
The incident highlights ongoing challenges in protecting signing infrastructure and the speed at which large sums can be moved on public blockchains. It also demonstrates the effectiveness of rapid coordination between exchanges, stablecoin issuers, and analytics firms in freezing assets before they can be fully laundered.
Industry observers point to the need for continued investment in multi-signature controls, real-time monitoring, and international law enforcement cooperation. Past attacks attributed to North Korean groups have prompted increased scrutiny from regulators in the United States and elsewhere.
While Binance users have been assured their balances are protected, the event is likely to prompt renewed discussion about custody practices, insurance mechanisms, and the overall maturity of security standards across the sector. Recovery efforts and any arrests will be watched closely in the coming weeks.
Additional reporting from Al Jazeera and CoinDesk has corroborated the timeline, attribution assessments, and recovery figures, providing a consistent picture across independent outlets.
