Cryptocurrency platform Binance has been it with what is believed to be the biggest single cybersecurity incident ever, with customers losing a massive $6,3-billion.
The company has pledged to cover the losses.
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions,” a company spokesman says.
“We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.”
The estimated total impact sits at around $6,3-billion.
“We have worked with blockchain partners to freeze affected assets, with about $3-billion frozen on-chain so far,” spokesman adds.
“Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. Deposits remain unaffected and continue to operate as normal. We will also publish an updated Proof of Reserves once the remediation is complete.”
As an immediate precaution, Binance has:
- Temporarily suspended withdrawals while our team completes a security revamp of the withdrawal service and its related addresses.
- Revoked the affected address authorisation.
- Engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Phoebe Hodgson, Banking and Payments Senior Analyst at GlobalData, comments: “The reported $6,3-billion cyberattack on cryptocurrency exchange Binance has raised fresh concerns about the scale and sophistication of threats targeting financial intuitions. With investigators examining the possibility of compromised employee access and state-linked involvement, the incident raises uncomfortable questions about whether traditional security approaches can keep pace with increasingly sophisticated attackers.
“Attackers are no longer focused solely on breaking into systems or stealing customer data. They are increasingly seeking to exploit the trust embedded within financial infrastructure, turning legitimate access and transaction processes into mechanisms for moving money.
“For financial institutions, the implications are significant. Decades of investment in cybersecurity has strengthened traditional defenses, yet the growing complexity of digital banking and AI have created new vulnerabilities. According to GlobalData’s Wealth Management Industry Conditions Analytics 2026, the greatest threat to the wealth management industry is cybersecurity threats. Of the institutions surveyed 65% said this was their greatest concern, up from 56% in 2025 (478 wealth management companies across 20 markets were surveyed in Q2 2026). Such attitudes can be relayed into retail banking, payments and other financial industries. As institutions become more interconnected and dependent on automated processes, the distinction between a security breach and a major financial loss is becoming dangerously narrow.
“The real challenge is that sophisticated attackers do not necessarily need to defeat every security control. They only need to find one trusted pathway that allows them to operate undetected. Once inside, the speed of modern financial transactions can leave institutions with precious little time to intervene.
“This demands a fundamental change in thinking. Cybersecurity can no longer be judged primarily by how effectively institutions keep attackers out. Banks must assume that some defenses will eventually fail and design their operations to prevent a single compromise from becoming a financial catastrophe.
“Ultimately, the Binance hack reinforces a critical message for financial-services leaders: the next generation of cyber resilience will be defined not by whether institutions can prevent every breach, but by whether they can stop attackers from turning that breach into irreversible financial loss.”
Georgy Kucherin, Senior Security Researcher at Kaspersky GReAT, comments: “Late October saw two major cybersecurity incidents in the cryptocurrency sector involving Binance and Polymarket. On October 30, Binance disclosed that it had suffered a hack, with its initial investigation indicating that a compromised DevOps engineer’s laptop may have enabled an attacker to access a service container and submit unauthorised withdrawal transactions.
“The exchange said it had found no evidence of a wallet private-key leak, temporarily suspended deposits and withdrawals and pledged to cover user losses. A day earlier, on October 29, Polymarket users were affected in a separate hack linked to a compromised third-party DebugBear real-user-monitoring script embedded in the platform’s website.
“The two cases point to very different attack paths: an internal workstation in one instance and a third-party web component in the other. Further investigation will have to determine exactly how the Binance DevOps engineer’s laptop and DebugBear were compromised, although the possibility that vulnerabilities were exploited in the process cannot be ruled out. At the same time, these incidents illustrate that cryptocurrency exchanges are not immune to cyberattacks and can be compromised through a range of vectors, with both internal systems and external dependencies potentially serving as attack surfaces.
“As our practice shows, employees of crypto exchanges, particularly technical specialists, remain as weak points in attacks aimed at stealing cryptocurrency: even experienced engineers and developers can become victims of cyberattacks and, in some cases, inadvertently download malware. We previously reported a case in which a developer in the cryptocurrency sector downloaded a malicious extension for a development environment, resulting in the theft of $500,000 from his wallets.”
The Binance attack appears to be the largest cryptocurrency theft on record, and an operation of this scale would be difficult to carry out, Kucherin says.
“So the possibility that some exchange hacks may in fact be the work of APT actors cannot be ruled out. Early reports regarding the Binance incident point to the possible involvement of various groups, with some specifically mentioning the Lazarus APT group. Lazarus is known for financially motivated cyberattacks, including operations targeting cryptocurrency, and has extensive experience in this area. In 2016, the group was accused of hacking Bangladesh’s central bank in an attempted theft of $1-billion. That was not an isolated case: throughout the current decade, Lazarus has remained active in attacks on crypto exchanges – for example, the 2025 compromise of Bybit resulted in losses of about $1.5 billion. At the same time, with regard to the attacks on Binance and Polymarket, Lazarus’s possible involvement remains under examination and final conclusions can only be drawn once the investigation is complete.
“Cryptocurrency asset holders have increasingly become targets of malicious actors in recent years, with devices lacking security solutions being of particular interest to attackers. In practice, even technically proficient users can fall victim to such attacks, which is why we strongly recommend installing security solutions on both personal and corporate devices.”