At 20:05 UTC on 29 October 2026, money began leaving Binance wallets on the XRP Ledger. Within about 20 minutes, most of roughly US$6.36 billion had moved out of Binance wallets across ten blockchains, according to blockchain analytics firm TRM Labs. That makes it the largest crypto theft on record, about four times the US$1.5 billion Bybit hack of February 2025.
TRM attributes the attack, with high confidence, to TraderTraitor, North Korea’s state-sponsored hacking unit. This article sets out what is known, what is still disputed, and what security teams outside crypto can learn from it.
The numbers, and why they differ
Different sources give different totals, and that is normal in the first days of a major incident. Valuation timing, scope and counting methods all matter.
| Source | Figure and what it measures |
| Binance | Estimated impact of about $6.3 billion, with about $3 billion frozen on-chain so far |
| TRM Labs | About $6.36 billion taken, valued at the moment of each transfer (about $6.23 billion at current prices). About $2.7 billion frozen, and about $2.4 billion still held by the attacker. |
| Chainalysis | $5.9 billion at the time of the theft, according to Forbes |
| CryptoQuant’s head of research | About $2.9 billion still in the attacker’s wallets, according to Forbes |
How the attack unfolded
TRM’s on-chain reconstruction shows an attack that was prepared well in advance. On the morning of 28 October, the attacker’s operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from. Early on 29 October, the operator tested its code on two wallets, then rehearsed the final version on a third. About four hours later, the same code was installed on a Binance hot wallet.
The theft itself began on the XRP Ledger, where five Binance wallets sent 233.46 million XRP to one address between 20:05 and 20:09 UTC. At 20:20, a Binance Bitcoin hot wallet sent 18,270 BTC to the attacker, who began splitting it into round pieces. On Ethereum, the attacker used a feature called EIP-7702.
In plain terms, EIP-7702 lets an ordinary Ethereum wallet hand control of its behaviour to a smart contract by signing an authorisation. The attacker submitted one transaction with 50 such authorisations, all signed by the Binance hot wallet and all pointing it to a contract only the attacker could command. Because the wallet processes a steady stream of withdrawals, the attacker prepared signatures for 50 consecutive transaction counts so that one would still be valid when the transaction executed. One matched. About three and a half minutes later, a single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
A second wave at about 23:05 UTC reached Binance wallets on Avalanche and Polygon.
How did the attacker get in?
Binance has said its initial investigation suggests a compromised DevOps engineer’s laptop, which let an attacker reach a service container and submit unauthorised withdrawals. It said it found no evidence of a wallet private key leak, and that it has revoked the affected address authorisation. It has not published a root cause.
TRM points the same way from the outside. Early signs on Ethereum suggested the authorisations had been phished, but that does not explain the other nine chains. Wallets with different key types and signing schemes all produced valid signatures for the attacker within about half an hour. TRM’s assessment is that the attacker most likely gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing. In our reading, the two accounts are consistent, but neither is confirmed yet.
Who is behind it
TRM says it attributes the attack to TraderTraitor with high confidence, based on on-chain and off-chain intelligence. Chainalysis’ chief executive said his firm assessed the attack as likely the work of the same group, and the blockchain investigator ZachXBT called the attacker likely Lazarus. TraderTraitor is a unit within the wider North Korean Lazarus umbrella. The FBI named TraderTraitor as responsible for the Bybit hack in February 2025.
TRM lists several features shared with earlier North Korea-linked heists, including Bybit and the KelpDAO hack of April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. The laundering seen so far differs. It relies on large swaps through market makers and lending protocols, not the bridge-heavy pattern that followed Bybit. Chainalysis also reports that funds from September’s Bitget exploit have mixed with the Binance proceeds.
This is attribution by private firms, not a government finding. The reports we reviewed do not include an official US statement on this attack.
The freeze that changed the ending
Stablecoin issuers moved within minutes. By TRM’s count, Tether froze about 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD and World Liberty Financial 27.8 million USD1. Arbitrum’s Security Council, a body that can take emergency action on that network, also moved 8,426 ETH and 74.6 million ARB out of the attacker’s reach. Together, that is about US$2.7 billion.
The attacker raced the freezes. TRM says about 325 million USDT was sold to market makers through intent-based trading contracts for roughly 122,300 ETH, a discount of more than 10%. Another wallet borrowed about 19,760 ETH on the Aave lending protocol against stolen USDT, after which Aave froze the affected markets. The attacker now holds more than 420,000 ETH and 18,270 BTC, about US$2.4 billion that no issuer can freeze.
What Binance says about users and losses
Binance says user funds are safe and that it will cover all losses from its SAFU emergency fund and company funds. Forbes reports the fund holds 15,000 BTC, worth roughly US$1.17 billion. Deposits continue, but withdrawals were paused while Binance carried out what it called a security revamp of the withdrawal service and its addresses. It said it expected to resume within 48 hours and that a root-cause report would follow. These are company statements, not audited ones. The root-cause report and the date withdrawals resume are the next things to watch.
Six lessons for security teams
These are our analysis, drawing on TRM’s recommendations and public reporting.
- Treat privileged engineers’ devices as crown jewels. The Bybit hack began with a compromised Safe developer computer, and Binance’s early findings point to a DevOps laptop. Admin and engineering endpoints deserve the strongest controls you have.
- Separate signing paths. In this incident, one actor obtained valid signatures for wallets on ten chains within hours. Separate signing infrastructure and approvals by chain and wallet tier.
- Hold less in hot wallets. The money that can move in 20 minutes is the money exposed to a 20-minute attack. Limit hot balances and set withdrawal limits that a human must override.
- Watch for delegation. TRM advises alerting on any EIP-7702 delegation on a treasury wallet, which appears as code at an address that should have none, and treating a request for many authorisations as a sign of compromise.
- Build freeze relationships before you need them. Stablecoin freezes blunted the loss. Know whom to call at issuers, exchanges and law enforcement, and screen counterparties in real time, as TRM urges market makers to do.
- Plan the first 48 hours of communication. Binance paused withdrawals, promised cover and set a 48-hour target. Decide in advance who speaks, what you can promise and how you will prove it.
What is attribution, what is a claim, and what is binding
| Item | Status |
| TRM Labs and Chainalysis attribution to TraderTraitor | Private-sector assessments. TRM states high confidence. Not a government finding. |
| Binance statements on cause, losses and withdrawals | Company statements, preliminary and unaudited. No root-cause report yet. |
| FBI attribution of the Bybit hack to TraderTraitor (February 2025) | Government finding, for a different incident |
| TRM recommendations on delegation alerts and signing policies | Vendor guidance |
| CERT-In Directions of 28 April 2022 | Binding for covered entities in India. Specified incidents must be reported within 6 hours of noticing them, and ICT logs kept for a rolling 180 days within India. |
| The six lessons in this article | Our analysis |
Preparation against twenty minutes
The attackers prepared for more than 36 hours and moved in about 20 minutes. Defenders had to decide what to do in that window. Industry freezes saved a large part of the money, but about US$2.4 billion is still out of reach. The lasting lesson is about preparation: know where your signing power sits, who can reach it and how fast you can shut it down.
Synopsis
On 29 October 2026, about US$6.36 billion left Binance wallets in roughly 20 minutes. TRM attributes the attack to North Korea’s TraderTraitor, and about US$2.4 billion remains in the attacker’s hands. This blog explains how the attack unfolded, what is known and disputed about the cause, and six lessons for security teams.
Sources
- TRM Labs, “North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History”, 29 October 2026. https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
- Forbes, “Binance’s $6.3 Billion Hack Started With One Engineer’s Laptop”, 30 October 2026. https://www.forbes.com/sites/digital-assets/2026/10/30/binances-63-billion-hack-started-with-one-engineers-laptop/
- CNBC, “Billions in crypto frozen in Binance hack”, 30 October 2026. https://www.cnbc.com/2026/10/30/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next-.html
- CoinDesk, “Crypto’s longtime foe, North Korea’s Lazarus Group, likely behind Binance hack”, 29 October 2026. https://www.coindesk.com/policy/2026/10/29/crypto-s-longtime-foe-north-korea-s-lazarus-group-likely-behind-binance-hack-blockchain-sleuths
- CoinDesk, “Binance loses over $6 billion”, 29 October 2026. https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets
- NBC News, “North Korea was responsible for $1.5 billion ByBit hack, FBI says”, February 2025. https://www.nbcnews.com/tech/tech-news/fbi-says-north-korea-was-responsible-15-billion-bybit-hack-rcna193944
- Fortune, “How North Korea cracked Bybit’s crypto safe to steal $1.5 billion”, March 2025. https://fortune.com/crypto/2025/03/04/north-korea-bybit-hack-ethereum-safe-dprk-lazarus-group-tradertraitor
- CERT-In, Directions under Section 70B(6) of the IT Act, 28 April 2022. https://www.cert-in.org.in/Directions70B.jsp
About the Author
