Binance Hit by Biggest Crypto Heist — $6.36 Billion Allegedly Stolen by North Korean Group

On October 29, 2026, Binance reported that an attacker drained wallets across ten blockchains, resulting in an estimated loss of about $6.36 billion in cryptocurrency.

TRM Labs described the incident as the largest cryptocurrency theft on record, saying most of the stolen funds were moved out within roughly 20 minutes of the attack.

TRM’s investigation attributes the operation to TraderTraitor, a North Korean–linked hacking group that has targeted crypto platforms and financial organizations to steal digital assets.

According to TRM, Binance acknowledged a security incident, suspended withdrawals on several networks and said user funds were safe. The reported loss is more than four times the $1.5 billion stolen in the Bybit incident.

Earlier reporting on the Bybit multistage attack detailed how compromised infrastructure enabled another major theft; however, Binance has not publicly identified the initial entry point for this incident.

Binance Hit by Biggest Crypto Heist in History

TRM observed malicious activity involving a sweeper contract that repeatedly drained a Binance Ethereum hot wallet. Their analysis points to harmful smart contract code rather than a named endpoint malware family.

TRM attributes the operation to TraderTraitor with high confidence, citing blockchain records and off-chain intelligence. Preparation for the theft began at least 36 hours before the transfers: the operator received three small Tornado Cash withdrawals starting on October 28, then deployed and tested attack code against several wallets.

A final rehearsal occurred about four hours before the attacker installed the same code on a Binance hot wallet, indicating the operation was planned rather than opportunistic.

The first recorded theft took place on the XRP Ledger between 20:05 and 20:09 UTC, when five Binance wallets sent 233.46 million XRP. Transfers on Solana and Optimism followed. At 20:20 UTC, a Bitcoin hot wallet moved 18,270 BTC to the attacker, who immediately split the funds into smaller outputs using a peel chain.

Ethereum activity revealed the attack’s central technical mechanism: EIP-7702 delegation, which allows a wallet to authorize smart contract code to act on its behalf. At 20:20 UTC, the operator submitted 50 authorizations signed by a Binance wallet that pointed the wallet toward an attacker-controlled sweeper contract.

Unlike previously documented TraderTraitor campaigns that leveraged cloud compromises, TRM’s report does not establish how the attacker first gained access in this case. Each of the 50 authorizations covered a consecutive nonce (the counter tracking wallet operations); preparing many signatures increased the chance one would match the wallet’s current counter when executed. One authorization matched, and 3 minutes 24 seconds later a single sweep moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.

The delegation remained active and allowed six additional sweeps as new deposits arrived. The compromised wallet also controlled execution for another Binance smart account, enabling removal of 823 million USDC. At the same time, wallets on other networks continued to produce ordinary signed transfers; TRM therefore suspects compromised signing infrastructure rather than an Ethereum-only authorization phishing event. Binance had not published a root-cause report at the time of TRM’s analysis.

Frozen Funds, Laundering Activity, and Defensive Priorities

TRM valued the stolen assets at the prices at transfer time to arrive at the $6.36 billion estimate. Ethereum accounted for about $3.79 billion, Bitcoin about $1.47 billion, and Tron about $628 million. These figures reflect blockchain observations through October 30 at 00:30 UTC and are subject to change as funds move or prices fluctuate.

Issuers and network responders restricted roughly $2.7 billion of the stolen value. Tether, Circle, Ripple and World Liberty Financial froze stablecoin balances, while Arbitrum’s Security Council removed 8,426 ETH and 74.6 million ARB from the attacker’s control. Those actions limited access to portions of the stolen assets but do not constitute proof that the funds have been returned to Binance.

The attacker converted about 325 million USDT into roughly 122,300 ETH via market makers and trading contracts. Another wallet deposited 60 million USDT into Aave and borrowed about 19,760 ETH. TRM notes that prior investigations into Lazarus laundering networks show why tracing counterparties matters, but those findings are not evidence that specific entities participated in this theft.

TRM recommends that defenders screen deposits and trading counterparties, alert on unexpected wallet delegations, and reject unapproved EIP-7702 authorizations. Exchanges should separate signing systems and approval paths across blockchains and wallet tiers. Treasury and security teams need tested revocation procedures because a malicious delegation can continue to redirect incoming funds after an initial theft.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, using “[.]”) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intel from 16K SOCs.