Binance hack: Lazarus group suspected as $6.3b theft rattles traders

Dubai: The crypto world woke up to its worst nightmare on Friday. Binance, the world’s largest crypto exchange, was hacked. It is estimated that about $6.3 billion has gone missing, making this the biggest crypto theft on record. 

CNN reports that North Korea’s Lazarus Group could be behind the attack. Blockchain investigators support that view, but Binance has not named the attacker yet. In its latest update, Binance says that investigation has revealed that the attack was more ‘complex’ than what was initially reported.

Co-CEO Yi He has confirmed that withdrawals should restart within 45 hours, however, it will be gradual. The crypto firms says that deposits are working normally, but the company is rebuilding its withdrawal system to address controls first. About $3 billion has been frozen on-chain. Other crypto firms like Tether, Circle and Arbitrum’s Security Council have helped with the freezes.

The Changpeng Zhao led exchange has pledged to cover every loss from its SAFU emergency fund and company money. The SAFU fund has historically held about $1 billion according to reports. The exchange will also publish an updated Proof of Reserves and a technical report to assure investors.

What happened on Oct 29?

Funds left Binance-controlled wallets across ten blockchains, according to analytics firm TRM Labs. Binance’s preliminary finding points to a compromised laptop belonging to a DevOps engineer. That access allowed the attacker to reach a service container and submit unauthorized withdrawals. The exchange found no evidence to suggest that wallet private keys were leaked.

Zhao called it a hack before Binance did. The exchange then edited its first statement twice in 13 minutes. Both moves fed the unease among people who’ve parked their money with the exchange. Markets were quick to react too, Bitcoin fell 4.5 per cent to $76,664 and BNB the native token by Binance dropped 7.1 per cent. More than $1.5 billion in leveraged bets was wiped out. Institutional investors rushed to pull funds from exchanges, and India’s CoinDCX curbed futures trading. 

The Lazarus link

TRM has attributed the attack to TraderTraitor, a Lazarus subunit, with “high confidence”. Chainalysis chief executive Jonathan Levin also derived the same conclusion. Crypto investigator ZachXBT has also suggested that the attacker is “likely Lazarus”. While many are pointing the blame towards the North Korea associated group, few others are also pointing out that Lazarus usually launders funds faster than this attacker has. Binance disclosed on October 27 that it had blocked North Korea-linked attacks using fake job interviews. 

The Lazarus group has become infamous among the crypto community for such hacks.In February 2025 it stole $1.46 billion (Dh5.4 billion) from Dubai-based exchange Bybit, then the largest hack on record. It also took $625 million (Dh2.3 billion) from the Ronin Network in 2022.

This year, the group is believed to be behind the $292 million (Dh1.07 billion) KelpDAO exploit in April. Experts also suspected North Korea in the $280 million (Dh1.03 billion) Drift hack that month.

Are crypto traders and investors worried?

Some reddit and X users have used the social platforms to voice their concerns.Some users distrust Binance’s assurance that customer funds are safe. One replied bluntly: “FTX said the same thing.” Others point out that Binance has repaid users after past breaches. 

Some pointed out to the fact that markets had not come crashing down because Binance already has a contingency plan. “The reason why the market is down only 2-3% after the biggest crypto hack in history is simple: there's no domino effect…Binance has the funds to cover it. Nobody else takes the hit.”

One Reddit user asked where to keep money now, since neither exchanges nor cold wallets feel safe.