North Korea-Linked Hackers Allegedly Steal $6.36 Billion From Binance In Biggest Crypto Heist Ever

TRM Labs points finger at Pyongyang’s elite TraderTraitor hacking unit after a coordinated attack drains Binance wallets across 10 blockchains in just 20 minutes; around $2.7 billion frozen, but attackers still hold assets worth $2.4 billion

In what is being described as the biggest cryptocurrency heist in history, hackers allegedly linked to North Korea have stolen approximately $6.36 billion from Binance, the world's largest cryptocurrency exchange, in a coordinated attack targeting its wallets across 10 blockchain networks.

As per reports, blockchain intelligence firm TRM Labs has attributed the October 29 attack, with high confidence, to TraderTraitor, North Korea's elite hacking unit. The attackers reportedly moved most of the funds within just 20 minutes, triggering an unprecedented scramble among cryptocurrency firms and blockchain authorities to freeze the stolen assets.

Despite the emergency response, approximately $2.7 billion has been frozen, while the attackers are believed to retain more than 420,000 ETH and 18,270 BTC, together worth around $2.4 billion.

The scale of the theft is nearly four times the $1.5 billion Bybit hack of February 2025, previously one of the largest cryptocurrency heists on record.

North Korean Hacker Group TraderTraitor Under Scanner

TRM Labs said its assessment linking the attack to TraderTraitor was based on extensive on-chain and off-chain intelligence. The firm identified similarities with previous cryptocurrency thefts attributed to North Korean hackers, including the Bybit hack in February 2025 and the KelpDAO hack in April 2026.

Investigators found that the attacker had begun preparing for the operation at least 36 hours before the funds were transferred.

The operator wallet received three small withdrawals from Tornado Cash, a service used to obscure the origin of cryptocurrency transactions, beginning on October 28. The attacker then deployed and tested malicious code on multiple wallets before installing the final version on a Binance hot wallet.

The FBI had previously identified TraderTraitor as responsible for the $1.5 billion Bybit theft.

$6.36 Billion Drained Across 10 Blockchain Networks

According to TRM Labs, the attacker moved approximately $6.36 billion from Binance-attributed wallets across 10 blockchains. The transfers began around 20:05 UTC on October 29, with most of the funds moved within approximately 20 minutes.

Ethereum accounted for the largest share, with approximately $3.79 billion transferred, including 200,630 ETH and several other tokens.

Bitcoin outflows totalled 18,270 BTC, worth around $1.47 billion. The Tron network lost 612.7 million USDT and 46.4 million TRX, valued at approximately $628 million.

The attack also drained 233.46 million XRP from the XRP Ledger, approximately $296 million in value, and 970,500 SOL from Solana, worth around $96 million.

Additional transfers affected Arbitrum, Optimism, Base, Avalanche and Polygon.

How Hackers Allegedly Took Control Of Binance Wallets

TRM Labs' investigation points to a possible compromise of Binance's hot wallet signing infrastructure.

A hot wallet is an internet-connected cryptocurrency wallet used by an exchange to process customer withdrawals.

On Ethereum, the attacker exploited a mechanism known as EIP-7702, which allows an ordinary wallet to delegate control of its behaviour to a smart contract through a signed authorisation.

The attacker prepared 50 pre-signed authorisations in advance, each pointing the Binance hot wallet towards a sweeper contract under the attacker's control.

At around 20:20 UTC, the attacker submitted a transaction containing those authorisations. One of them matched the wallet's transaction count and enabled the delegation.

Just three minutes and 24 seconds later, the attacker instructed the compromised wallet to transfer its entire balance to an attacker-controlled address. The transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.

The attacker continued sweeping additional funds entering the wallet at several intervals. The compromised wallet also served as the executor of a separate Binance smart account, allowing the attacker to withdraw another 823 million USDC.

Attack Raises Questions Over Binance's Security Infrastructure

The Ethereum transactions initially suggested that the attacker may have obtained wallet authorisations through phishing. However, TRM Labs said this explanation did not account for the simultaneous transfers across other blockchain networks.

Binance wallets on Bitcoin, Tron, Solana, the XRP Ledger, Arbitrum, Avalanche, Optimism and Base also sent funds to attacker-controlled addresses through standard signed transfers.

These wallets used different blockchain networks, key types and signing systems, yet all produced valid signatures for the attacker within a short period.

TRM Labs believes the most likely explanation is that the attackers gained the ability to make Binance's hot wallet signing system approve transactions of their choice across multiple networks.

Binance has confirmed a security incident and temporarily suspended withdrawals on several networks as a precaution. The exchange has maintained that user funds are safe. However, it has yet to publish the root cause of the breach.

Tether, Circle And Other Firms Freeze $2.7 Billion

As billions of dollars moved out of Binance wallets, cryptocurrency companies and blockchain authorities rushed to block the stolen assets.

TRM Labs estimated that approximately $2.7 billion had been frozen on-chain by October 30 at 00:30 UTC.

The major interventions included:

• Tether: Approximately $1.77 billion in USDT frozen across multiple attacker-controlled wallets.
• Circle: Approximately $825 million in USDC frozen, including 823 million USDC in the main receiving wallet.
• Ripple: Approximately $40.5 million in RLUSD frozen.
• World Liberty Financial: Approximately $27.8 million in USD1 frozen.
• Arbitrum Security Council: 8,426 ETH and 74.6 million ARB, worth approximately $30 million, moved out of the attacker's reach.

Binance had earlier reported that the verified amount of frozen assets had reached $2.54 billion.

Hackers Race To Convert Stolen Crypto Before Freeze

While cryptocurrency firms were freezing assets, the attackers were attempting to convert stablecoins into cryptocurrencies that could not be frozen by centralised issuers.

TRM Labs found that approximately 325 million USDT was sold to professional market makers through UniswapX and other trading contracts in exchange for around 122,300 ETH. The conversion reportedly took place at a discount of more than 10% compared with the prevailing ETH market price.

Another attacker-controlled wallet supplied 60 million USDT to the Aave lending protocol and borrowed approximately 19,760 ETH against it.

On the Tron network, 300 million USDT was moved to a wallet that began supplying the funds to the JustLend lending protocol.

The attackers also moved funds through multiple wallets and decentralised exchanges in an attempt to evade freezing measures.

$2.4 Billion Still Beyond Reach

Despite the coordinated intervention by stablecoin issuers and blockchain authorities, a substantial portion of the stolen cryptocurrency remains beyond their reach.

TRM Labs estimates that the attackers still control more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion.

The firm expects the next stage of the laundering operation to involve cross-chain bridges, cryptocurrency swap services and over-the-counter brokers.

TRM Labs is tracking the movement of the stolen Bitcoin and Ethereum and alerting industry partners through its Beacon Network.

The incident has also prompted warnings to cryptocurrency exchanges, compliance teams and market makers to screen incoming deposits and transactions against the attacker addresses identified by investigators.