Binance Faces Largest Crypto Heist – $6.36 Billion Reportedly Stolen by North Korean Group

Binance reportedly lost approximately $6.36 billion in cryptocurrency on October 29, 2026, after an attacker drained wallets across ten blockchains.

TRM Labs describes the incident as the largest cryptocurrency theft ever recorded, with most of the stolen funds transferred out within about 20 minutes of the attack.

Its investigation attributes the operation to TraderTraitor, a North Korean-linked hacking group known for targeting cryptocurrency platforms and financial organizations to steal digital assets.

According to TRM, Binance acknowledged a security incident, suspended withdrawals on several networks, and said user funds were safe. The reported loss exceeds four times the $1.5 billion Bybit theft.

Earlier reporting on the Bybit multistage attack investigation explains how compromised infrastructure enabled another major cryptocurrency theft, although Binance’s initial entry point remains unknown.

Binance Hit by Biggest Crypto Heist in History

Researchers from TRM identified malicious sweeper contract activity that allowed the attacker to repeatedly drain a Binance Ethereum hot wallet.

Their published Binance hack analysis describes harmful smart contract code rather than a named endpoint malware family. TRM attributes the operation to TraderTraitor with high confidence, citing blockchain records and intelligence gathered outside the blockchain.

Preparation began at least 36 hours before the theft. The operator received three small Tornado Cash withdrawals starting October 28, then deployed and tested attack code against several wallets.

A final rehearsal preceded installation of the same code on a Binance hot wallet by approximately four hours, suggesting a planned operation rather than an opportunistic transfer.

The first recorded theft occurred on the XRP Ledger between 20:05 and 20:09 UTC, when five Binance wallets transferred 233.46 million XRP.

Solana and Optimism transfers followed. At 20:20 UTC, a Bitcoin hot wallet sent 18,270 BTC to the attacker, who immediately split the funds into smaller amounts through a peel chain.

Ethereum activity exposed the attack’s central technical feature: EIP-7702 delegation. This mechanism lets a wallet authorize smart contract code to control its behavior.

At 20:20 UTC, the operator submitted 50 authorizations signed by Binance’s wallet, directing it toward an attacker-controlled sweeper. Unlike previously documented TraderTraitor cloud compromise campaigns, this report does not establish how access was first obtained.

Each authorization covered a consecutive nonce, the counter used to track wallet activity. Preparing multiple signatures increased the chance that one would match the wallet’s current counter when executed.

One matched. Three minutes and 24 seconds later, a single sweep transferred 167,464 ETH and 63 tokens, including 1.615 billion USDT.

The delegation remained active, allowing six further sweeps as fresh deposits arrived. The compromised wallet also controlled execution for another Binance smart account, enabling the removal of 823 million USDC.

Meanwhile, wallets across other networks produced ordinary signed transfers. TRM therefore suspects compromised signing infrastructure, not an Ethereum-only authorization phishing incident. Binance had not published a root cause in the report.

Frozen Funds, Laundering Activity, and Defensive Priorities

TRM valued the stolen assets at their prices when transferred, producing the $6.36 billion estimate. Ethereum accounted for approximately $3.79 billion, followed by Bitcoin at $1.47 billion and Tron at $628 million.

Its figures reflect blockchain observations through October 30 at 00:30 UTC, meaning subsequent movements or price changes could alter later assessments.

Issuers and network responders restricted approximately $2.7 billion. Tether, Circle, Ripple, and World Liberty Financial froze stablecoins, while Arbitrum’s Security Council removed 8,426 ETH and 74.6 million ARB from the attacker’s control.

These actions limited access to funds; they did not establish that the assets had been returned to Binance. The attacker also converted approximately 325 million USDT into roughly 122,300 ETH through market makers and trading contracts.

Another wallet deposited 60 million USDT into Aave and borrowed about 19,760 ETH. Earlier investigations into Lazarus cryptocurrency laundering networks illustrate why tracing counterparties matters, although those findings should not be treated as proof of participants in this incident.

TRM recommends screening deposits and trading counterparties, alerting on unexpected wallet delegations, and rejecting unapproved EIP-7702 authorizations.

Exchanges should separate signing systems and approval paths across blockchains and wallet tiers. Treasury teams also need tested revocation procedures because a malicious delegation can keep redirecting incoming funds after the initial theft.

Indicators of compromise (IoCs):-

Indicator type	Source-reported observation
Wallet delegation	Unexpected EIP-7702 code on treasury wallets
Signing behavior	Batch of 50 consecutive-nonce authorizations
Fund movement	Repeated sweeps of incoming deposits
Bitcoin laundering	Peel-chain outputs of 1,000 and 100 BTC

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.