Марія Бровінська Crypto 30 October 2026, 07:31

The biggest hack in history: $6.36 billion stolen from Binance in 20 minutes, North Korean TraderTraitor is named as the perpetrator. 10 questions and answers about the biggest theft in the history of the crypto industry

On the night of October 29, an unknown attacker withdrew approximately $6.36 billion across ten blockchains from the wallets of the world’s largest cryptocurrency exchange Binance. This was reported by blockchain analytics company TRM Labs. According to its assessment, this is the largest cryptocurrency theft in history and about four times more than the Bybit exchange hack in February 2025 ($1.5 billion). Most of the funds were withdrawn in about 20 minutes, starting at 20:05 UTC (22:05 Kyiv time).

TRM attributes the attack with “high confidence” to TraderTraitor, an elite unit of North Korean hackers. Binance confirmed the security incident and suspended withdrawals on several networks, and said that user funds are safe, TRM reported. The root cause of the attack has not yet been disclosed by the exchange. TRM’s data is current as of 00:30 UTC, October 30, and the story is developing.

How much was stolen and where?

TRM traced every transfer from wallets owned by Binance to the attacker’s addresses on ten networks. At prices at the time of the theft, the amount is $6.36 billion, at current prices the same assets are worth about $6.23 billion.

Ethereum: about $3.79 billion. This is 200,630 ETH and 185 other tokens, including 1.875 billion USDT, 823 million USDC, and 88.5 million RLUSD.
Bitcoin: 18,270 BTC, about $1.47 billion.
Tron: 612.7 million USDT and 46.4 million TRX, about $628 million.
XRP Ledger: 233.46 million XRP, about $296 million.
Solana: 970,500 SOL, about $96 million.
Arbitrum, Optimism and Base: together about $39 million, including 74.6 million ARB on Arbitrum.
Avalanche: about $28 million, Polygon: about $10 million.

How the attack unfolded

The preparation took at least 36 hours. On the morning of October 28, the attacker’s wallet received three small withdrawals from Tornado Cash, a service that hides the origin of funds. Early on October 29, the attacker deployed the first piece of code and tested it on two wallets. He then tested the final version on a third, returned the test funds to himself, and four hours later, the same code was installed on a Binance hot wallet.

The XRP Ledger was the first to go down: from 20:05 to 20:09 UTC, five Binance wallets sent 233.46 million XRP to a single address, each leaving a minimal balance. Shortly after 20:10 UTC, the transfers began with Solana and Optimism. At 20:20, the Binance Bitcoin wallet transferred 18,270 BTC. The attacker immediately began breaking them into round chunks of 1,000 and 100 BTC (a so-called peel chain) to make tracking more difficult. Within two minutes, the Binance Tron wallet sent 612.7 million USDT and 46.4 million TRX. The second wave hit wallets on Avalanche and Polygon around 23:05 UTC.

How an Ethereum hot wallet was hijacked

A hot wallet is an exchange wallet connected to the internet to process customer withdrawals. The Ethereum wallet in this case is one of the most famous on Binance.

The attacker exploited EIP-7702, a mechanism from the Ethereum Pectra update (May 2025): by signing an “authorization,” a regular wallet hands control of its behavior to a smart contract. From then on, every invocation of the wallet executes the code of that contract until the wallet signs a new authorization.

At 20:20 UTC, the operator sent a single transaction with 50 authorizations. Each was signed by the Binance wallet, and each pointed to a “sweeper” contract that executes commands only by the operator. The authorization is valid only for a specific transaction counter (nonce) of the wallet. Since the Binance wallet is constantly processing withdrawals, its nonce increases rapidly. By preparing 50 signatures in a row, the attacker guaranteed that one of them would match at the time of execution. And so it did. The signatures were generated in advance in a single batch.

3 minutes and 24 seconds after the delegation, the operator ordered the wallet to send the entire balance to its address: 167,464 ETH and 63 tokens, including 1.615 billion USDT. The delegation remained in effect, so the attacker withdrew new funds arriving in the wallet six more times: at 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56 UTC. This same wallet acted as an executor for a separate Binance smart account, which gave the attacker access to 823 million USDC. Circle froze them shortly after.

Why TRM believes the signing infrastructure is compromised

At first, it seemed that the authorizations could be phished. But only Ethereum explains this. In the same half hour, five Binance wallets on XRP Ledger, wallets on Arbitrum, Avalanche, Optimism and Base, a Bitcoin wallet, a Tron wallet and a Solana wallet sent funds to the attacker via regular signed transfers. Another Binance hot wallet on Ethereum sent 28,006 ETH, 55.7 million USDT and 25.9 million RLUSD in the same way, without any delegation.

These wallets run on different blockchains, with different key types and signature schemes, and all of them gave the attacker valid signatures within about half an hour. TRM estimates that the attacker was most likely able to force Binance’s hot wallet signature system to sign any transactions on different blockchains. A batch of 50 pre-signed authorizations could mean that access was time-limited or that signatures had to be requested through the system.

Who is behind this?

TRM attributes the attack to TraderTraitor, North Korea’s most powerful hacking group. The company says it has high confidence, citing on-chain analysis and off-chain intelligence sources. The FBI previously identified the same group as the perpetrator of the $1.5 billion Bybit hack in February 2025.

According to TRM, the attack shares common features with previous North Korean heists (Bybit and KelpDAO in April 2026): small withdrawals from Tornado Cash to fund the operator’s wallet, preparation well in advance of the heist, and pre-obtained signatures executed in a single flash. However, the laundering observed differs from the post-Bybit pattern, where bridges dominated: this time, large exchanges via market makers and credit protocols.

How much was frozen?

Stablecoin issuers acted quickly. At 23:35 UTC, Binance reported that the verified frozen amount had reached $2.54 billion. With later freezes, TRM accounts for approximately $2.7 billion as of 00:30 UTC:

Tether, about 1.77 billion USDT. At 21:01 UTC, 37 minutes after the main withdrawal, Tether froze 971.1 million USDT on the main receiving wallet. Later withdrawals went to the already frozen wallet, and now there is 1.175 billion USDT. Also frozen are 205 million USDT on two other wallets of the attacker in Ethereum, 378.7 million USDT on two in Tron, 8.4 million USDt on Avalanche, and another 6.2 million USDT0 on Polygon.
Circle, about 825 million USDC. 823 million USDC on the main wallet was frozen at 21:04 UTC, in coordination with law enforcement, and later another 1.56 million USDC, which the attacker exchanged with AVAX and transferred from Avalanche to Ethereum.
Ripple, 40.5 million RLUSD. The wallet containing the stolen RLUSD was frozen at 22:01 UTC, when it had 40.5 million of the 88.5 million remaining. RLUSD was also frozen on the compromised Binance wallet to prevent new deposits from being withdrawn. Binance co-chair Yi He said Ripple helped stop about $200 million, but TRM confirms only 40.5 million RLUSD is on-chain.
World Liberty Financial, USD 27.8 million1. Frozen at 22:10 UTC on the main wallet and at 22:26 UTC on the Binance wallet.
Arbitrum Security Council, 8,426 ETH and 74.6 million ARB (about $30 million). The Network Security Council forcibly transferred these funds from the attacker’s wallet to Arbitrum at 00:08 UTC.

How the attacker "outsmarted" the freeze

Within the first few hours, he converted the stablecoins that could be frozen into assets that no issuer controlled, and at a deep discount. About 325 million USDT was sold to professional “fillers” and market makers via UniswapX and other intent contracts for about 122,300 ETH. This corresponds to a price of about $2,650 per ETH at a market price of $2,300–2,350, a discount of more than 10%. The remaining 175 million USDT from this batch has been frozen.

The attacker’s second wallet deposited 60 million USDT into Aave and lent about 19,760 ETH against it, after which Aave froze the relevant markets. On Tron, 300 million USDT was deposited into a wallet that began depositing it into the JustLend protocol. Another 200 million USDT passed through a chain of intermediary wallets with an exchange to Uniswap, 30 million USDT from this chain is frozen. 88.5 million RLUSD passed through the two wallets, from which 48 million were sold through decentralized exchanges between 21:42 and 22:01 UTC, before Ripple froze the remaining 40.5 million.

How much does the attacker have left?

As of 00:30 UTC, the attacker controls over 420,000 ETH and 18,270 BTC, about $2.4 billion in assets that no issuer can freeze. Given previous large thefts, TRM expects the next phase to utilize cross-chain bridges, exchange services, and OTC brokers, and is monitoring consolidation wallets and peel chain exits.

What TRM advises exchanges and compliance teams

Check deposits and counterparties at the attacker’s addresses, which were marked by TRM: funds from peel chain and ETH consolidation wallets will most likely reach exchanges, exchange services and OTC in the coming days.
Treasury teams should monitor ethereum-compatible wallets for EIP-7702 delegation, which appears to be code at an address that shouldn’t have it, and have a pre-agreed, tested way to sign the revocation.
In signature policies, reject EIP-7702 authorizations if they are not expected, and consider requesting multiple authorizations for a nonce range as an indicator of compromise.
Separate signature infrastructure and consensus paths across networks and wallet levels: Here, one actor obtained valid signatures for wallets across ten networks in a matter of hours.
Market makers and solvers should check counterparties before executing large orders: 325 million USDT was sold by a wallet that received them from a hack minutes before, and real-time address screening could have detected this.

What Binance says

In response to a request from the dev.ua editorial team, the Binance support chat responded on October 30 that the exchange had not announced an event during which the platform itself was “hacked” or compromised by hackers. According to the chat, there has been no exchange-wide incident of this type, nor has there been any platform shutdown, forced account closure, or massive loss of user funds. The response also states that all Binance.com services are operating normally, and users have full access to trading, deposits, withdrawals, transfers, and other functions.

The chat reminds us of the security risks at the individual account level: phishing, fake apps, compromised credentials, and unauthorized access. The summary of the response is as follows: there is no documented “Binance was hacked” event with consequences for all users, the services are working normally, and the responsibility for security and protection lies at the individual account level.

However, the editorial team did not find any official confirmation or denial from Binance as of the morning of October 30.

Binance stops supporting hryvnia: closing deposits, delisting USDT/UAH pair and automatic conversion