Wallets belonging to Binance, the world's largest cryptocurrency exchange, were emptied on the night of 29 October in an attack that took about $6.3 billion — the largest theft ever recorded in the industry. The two leading blockchain tracing firms, TRM Labs and Chainalysis, attribute the operation to TraderTraitor, a hacking group tied to the North Korean state.
TRM Labs puts the total at $6.36 billion, valued at each asset's price when it was moved, or $6.23 billion at current prices. Chainalysis says about $6.4 billion. Either count places the episode on a different scale: it is roughly four times the $1.5 billion Bybit theft, which had held the record since February 2025.
Twenty minutes, ten blockchains
The outflow began at around 8pm GMT on 29 October, and most of it happened in roughly 20 minutes. The funds were taken from hot wallets — the ones kept online to provide liquidity for trading — on ten different blockchains.
On Ethereum, according to TRM Labs, the attacker used EIP-7702, a feature introduced in the network's Pectra upgrade, to make a Binance wallet run a sweeper contract under the attacker's exclusive control. Fifty pre-signed authorisations were submitted, one for each of 50 consecutive transaction counts, so that one of them would necessarily be valid at the moment of execution. The delegation was then reused to drain the wallet and capture new deposits over the following hours.
On the other nine networks, the wallets simply sent the funds through ordinary signed transfers. For TRM Labs, that points to a compromise of Binance's signing infrastructure rather than a phishing attack confined to one chain — a judgement the firm itself flags as an assessment, not a confirmed root cause. Binance has not published a root cause.
The groundwork predates the attack: TRM Labs identified activity at least 36 hours earlier, with small Tornado Cash withdrawals funding the operator's wallet and the code tested on other wallets first.
How they got to North Korea
The attribution does not come from an official statement but from the trail on the blockchain itself. Chainalysis says its strongest evidence was watching, in real time, the funds stolen from Binance commingle with funds from last month's Bitget exploit, already attributed to North Korean actors; the conclusion was announced in the early hours of 30 October.
TRM Labs says it has high confidence in the attribution and cites similarities to the Bybit attack and to the KelpDAO exploit of April 2026. The FBI had already linked TraderTraitor to the Bybit case.
$2.8 billion frozen — and $2.4 billion still moving
Freezes began less than an hour after the outflow started and added up to about $2.8 billion by Chainalysis's count. TRM Labs' tally, closed at 00:30 GMT on 30 October, details $2.7 billion: about 1.77 billion USDT by Tether, 825 million USDC by Circle, 40.5 million RLUSD by Ripple, 27.8 million USD1 by World Liberty Financial and the equivalent of $30 million in ETH and ARB by the Arbitrum Security Council.
That gap explains why the figure moves: a stablecoin has an issuer, and an issuer can freeze a balance; bitcoin and ether do not. By TRM Labs' reckoning, the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion — and laundering is already under way. Some 325 million USDT was sold to market makers for roughly 122,300 ETH, at a discount of more than 10%; ETH was borrowed against USDT on Aave and USDT deposited on JustLend, a lending protocol on the Tron network; and the 18,270 BTC were run through a peel chain, in which the amount is sliced into round-number outputs to make tracing harder.
What Binance says
The exchange confirmed a security incident, said it was investigating and temporarily suspended withdrawals on several networks as a precaution. It also said "user funds are safe" and, at 23:35 GMT on 29 October, reported that verified frozen funds had reached $2.54 billion.
There is at least one point where the company's account and the public trail do not match: co-chief executive Yi He said Ripple had helped stop about $200 million from moving, but TRM Labs says it has confirmed only the 40.5 million RLUSD freeze onchain.
With information from TRM Labs and Chainalysis.
