Binance cyberattack involves over US$6 billion in assets; FBI reportedly joins investigation

Binance, the world's largest cryptocurrency exchange, has been hacked, prompting it to temporarily suspend withdrawals and some trading services.

The assets affected are estimated at US$6.3 billion (about S$8.053 billion), potentially making this the largest cryptocurrency theft on record. Prices of bitcoin and other cryptocurrencies fell on the news.

Reuters reported that, according to informants, Binance is working with law enforcement agencies worldwide, including the US Federal Bureau of Investigation (FBI) and the US Secret Service.

The FBI said in a statement that it was aware of the matter and working with relevant public and private sector partners to understand the scope of the incident, assess potential impacts and coordinate appropriate investigative measures.

Binance said on Thursday (29 October) that it was investigating a potential security breach and working with law enforcement agencies, cryptocurrency issuers, blockchain intelligence firms and other industry partners to trace and freeze related assets.

The company confirmed in a post on its Latin America account on social media platform X that the funds involved were estimated at about US$6.3 billion. It has so far worked with blockchain partners to freeze about US$3 billion in on-chain assets.

The company also said: “This was a sophisticated attack.”

Richard Teng, co-chief executive officer of Binance, said on social media on Friday afternoon Singapore time that preliminary investigations showed that a development and operations (DevOps) engineer's laptop had been compromised. This gave an attacker access to submit unauthorised withdrawal transactions.

Cryptocurrency prices fell broadly on Friday (30 October) after news of the security breach emerged. Bitcoin fell as low as US$77,646, its lowest level in six weeks, while Ether dropped to US$2,238.76, a two-month low. The BNB token, launched as Binance Coin and used to pay trading fees on Binance, fell more than 8%.

Binance conducted security checks after the incident and temporarily suspended withdrawals, saying it would resume them once the issue was fully resolved. As a precaution, it also suspended trading on its Binance Alpha platform.

He Yi, co-founder of the cryptocurrency exchange and co-chief executive officer, said the platform would cover all losses caused by the hack. Binance also stressed that users' funds remained safe.

Changpeng Zhao (commonly known as CZ), best known for co-founding Binance, no longer handles the company's day-to-day management, but said in a post on social media platform X that the incident looked like a hack.

Blockchain intelligence firm TRM Labs suggested that North Korean hacking group TraderTraitor was behind the attack. Several cryptocurrency companies have also taken steps to freeze related assets.

Stablecoin issuer Tether said it had frozen nearly US$1.57 billion in related assets, while fellow stablecoin issuer Circle froze more than US$800 million.

World Liberty Financial, a cryptocurrency company linked to US President Donald J. Trump and his family, also said it had worked with cryptocurrency custodian BitGo to freeze funds stolen in what it described as a Binance hack.

Another major exchange, Coinbase, said in a statement that it was closely monitoring developments: “Our team is doing everything we can to support in the current situation, including blocking sends to compromised wallets. We've also reached out to Binance to offer our help.”

Binance is the world's largest cryptocurrency exchange. Its 2024 annual report showed that the platform had more than 300 million registered users globally and about US$160 billion in assets under custody. The incident has renewed market concerns about the platform's security.

According to blockchain research firm TRM Labs, nearly 150 cryptocurrency thefts occurred worldwide last year, involving US$2.9 billion.

Carsten Menke, head of Next Generation Research at Julius Baer, said the incident appeared unrelated to the security of blockchain itself and was not a problem with cryptocurrencies themselves, but rather a corporate cybersecurity incident.

“While there is thus far no evidence that artificial intelligence (AI) played a role, the broader cybersecurity backdrop is becoming increasingly challenging as AI lowers the cost of sophisticated attacks and increases their speed.”

Binance previously operated in Singapore and established a local subsidiary. It also sought a licence from the Monetary Authority of Singapore in 2021, but later withdrew its application.

In September that year, Singapore authorities placed it on the Investor Alert List. In 2022, Binance’s Singapore platform announced its closure.