Stablecoin issuers froze about $2.67bn, but the attacker still holds roughly $2.4bn in ETH and bitcoin beyond their reach.
Binance lost approximately $6.36bn across ten blockchains in what TRM Labs has called the largest cryptocurrency theft on record, with the blockchain intelligence firm attributing the attack to North Korea’s TraderTraitor unit.
It is also the largest financial hack ever, of any kind.
TRM said most of the funds left Binance wallets within about 20 minutes of the first transfer at 20:05 UTC on 29 October, draining wallets on Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. The total is roughly four times the $1.5bn taken from Bybit in February 2025, a theft the FBI attributed to the same group.
“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence,” the firm said, adding it had made the judgement with high confidence.
How the Binance hack happened
Binance put the estimated impact at around $6.3bn in a statement on X and said its initial investigation pointed to a compromised laptop belonging to a DevOps engineer, “which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions”.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.As an immediate precaution, Binance has:
– temporarily suspended deposits and withdrawals while security checks are completed;
– revoked the affected address authorisation;
– engaged law enforcement and blockchain intelligence partners to trace and recover funds.Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
https://t.co/ywB2mKFy0p
— Binance (@binance) October 30, 2026
The exchange said it found “no evidence of any private key leaks from wallets” and would publish a detailed technical analysis once its investigation was complete.
TRM’s on-chain analysis suggests preparation for the attack began at least 36 hours before the theft, when the attacker’s operator wallet received three small withdrawals from the Tornado Cash mixer, and the attack code was rehearsed on test wallets before being installed on a Binance hot wallet.
On Ethereum, the attacker used an EIP-7702 delegation, backed by 50 pre-signed authorisations, to hand control of one of Binance’s best-known hot wallets to a sweeper contract, which then moved 167,464 ETH and 1.615bn USDT out in a single transaction.
Because wallets on nine other chains, using different key types and signing schemes, sent funds to the attacker within the same half hour, TRM concluded the attacker had most likely gained the ability to make Binance’s hot wallet signing system approve transactions of its choosing.
Stablecoin issuers respond with $2.67bn freeze
Tether, Circle, Ripple and World Liberty Financial froze about $2.67bn in stablecoins overnight, and Arbitrum’s Security Council moved a further $30m in ETH and ARB out of the attacker’s control. Tether froze roughly 1.77bn USDT, locking the main receiving wallet 37 minutes after the principal sweep, while Circle froze 823m USDC in coordination with law enforcement.
The attacker sold about 325m USDT to market makers for around 122,300 ETH, accepting a discount of more than 10%, and borrowed ETH against USDT on Aave before the freezes could reach those funds.
TRM estimates the attacker still holds more than 420,000 ETH and 18,270 BTC, worth about $2.4bn, and expects the next stage of laundering to run through cross-chain bridges, swap services and over-the-counter brokers. The firm has urged exchanges, OTC desks and market makers to screen deposits and counterparties against the attacker addresses it has labelled.
**Service Update**
Deposits remain unaffected and continue to operate as normal.
Our team is currently working on enhancements to the withdrawal service and related address controls. We expect to begin resume withdrawal services in the next 48 hours.
We will continue to share updates through official Binance channels as progress is made.
— Yi He (@heyibinance) October 30, 2026
Binance suspended all deposits and withdrawals at about 00:30 GMT on Friday while it carried out security checks, froze funds and worked with law enforcement. Co-CEO Yi He said on X that “user funds are safe” and “Binance will cover all hacking losses”.
