October ended on a grim note for cybersecurity. On Friday, hackers reportedly stole billions of dollars from Binance, the world’s largest cryptocurrency exchange, in what was described as the biggest crypto heist on record. Here’s what is known so far and what Binance users should check.
The breach happened late Friday afternoon, October 30. The attackers reportedly took $6.34 billion from users’ accounts in roughly 20 minutes.
Blockchain investigation firm TRM Labs linked the attack to TraderTraitor, a North Korean hacking group. The FBI has also connected the group to the 2025 Bybit hack, in which about $1.5 billion in Ethereum was stolen, and the 2022 Ronin Network theft, which cost users roughly $620 million.
There’s no indication TraderTraitor used a PHP exploit to get into Binance’s systems. The company said the attack may instead have begun with an engineer’s compromised laptop. Investigators suspect a phishing message tricked the employee into opening a malicious link, allowing malware to give the hackers access to Binance’s trading systems.
Binance temporarily halted crypto withdrawals and deposits as it worked to limit further damage. By Saturday, the company said 90% of the missing assets had been returned to users’ accounts. Withdrawals for some cryptocurrencies resumed on Sunday, with more services expected to come back online gradually through Monday.
Binance users should review their accounts for any signs of missing funds, even if they don’t think they were affected. Because the breach involved the exchange’s internal systems, account credentials and seed phrases may not have been enough to protect users.
Binance has said it will automatically restore all lost funds, so users don’t need to file a claim. Still, it’s sensible to keep an eye on your account over the next few weeks and confirm that any missing assets are returned. If funds are still missing after Binance completes its reimbursement, contact the company’s support team.
The incident is a reminder that phishing can fool almost anyone, including employees at major technology and financial companies. Be cautious with unexpected emails, messages, and calls, particularly when they urge you to click a link. Even if a message appears to come from someone you know, check with them directly before opening anything that seems suspicious.
Some browsers offer built-in protection against phishing and malicious sites. Google Chrome’s Enhanced Protection mode, for example, uses AI to identify potentially dangerous websites and can block access to sites it considers a verified threat.
Binance wasn’t the only financial platform targeted on Friday. Polymarket also suffered an attack, though on a much smaller scale: just over 700 users reportedly lost a total of $2.7 million after a vulnerability in a third-party system was exploited. The issue was resolved, and trading has resumed.
