Binance, the world’s largest cryptocurrency exchange, has been hit by the biggest crypto heist ever recorded, and blockchain intelligence firms say North Korean state-sponsored hackers are the likely culprits.
Binance has put the damage at roughly $6.3 billion. TRM Labs, which followed each transfer on-chain, calculated about $6.36 billion siphoned from Binance wallets across ten blockchains on October 29. Most of the money left within roughly 20 minutes.
The haul dwarfs the $1.5 billion taken from Bybit in February 2025, which previously held the record. Binance has halted withdrawals and pledged to reimburse all losses using company funds and its Secure Asset Fund for Users (SAFU).
The exchange’s early findings suggest the intrusion may have started with an employee’s laptop.
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak,” Binance stated.
TRM’s analysis shows the attackers spent at least a day and a half getting ready. The wallet used to run the operation was funded with a few small Tornado Cash withdrawals, and the malicious code was trialed on other wallets before going live.
On Ethereum, the attackers leveraged EIP-7702, a mechanism through which a standard wallet can delegate its behavior to a smart contract by signing a permission. They sent a batch of 50 such permissions, all signed beforehand by a Binance hot wallet, so that one would match the wallet’s transaction count at execution time.
The Binance wallet ended up delegated to a contract that only the attackers could command, which they used to empty it.
According to TRM, the Ethereum activity initially looked like the result of phishing. That theory does not account for the other nine blockchains, where Binance wallets sent funds to the attackers through regular, validly signed transactions.
“These wallets use different chains, key types and signing schemes. All of them produced valid signatures for the attacker within about half an hour. In TRM’s assessment, the most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains,” TRM said.
Researchers point to North Korea
“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence,” the blockchain intelligence firm said.
TRM found traits this attack shares with the Bybit heist and the KelpDAO hack from April 2026. These include a mixer-funded operator wallet, preparations made long before any money moved, and signatures collected ahead of time and then used all at once.
The laundering seen so far sets this operation apart. Instead of leaning on cross-chain bridges as in the Bybit case, the hackers have mainly relied on big trades with market makers and on lending platforms.
Chainalysis CEO Jonathan Levin said his company also believes TraderTraitor is the likely perpetrator, citing ties to an earlier hack. Chainalysis investigators found proceeds from last month’s Bitget exploit mixed with funds taken from Binance.
Blockchain sleuth ZachXBT also named the Lazarus Group as the probable attacker.
The FBI attributed the Bybit theft to TraderTraitor. Binance has not publicly identified the hackers, saying it is cooperating with law enforcement to determine who they are.
Billions frozen, billions still movable
Stablecoin issuers were quick to act. By 00:30 UTC on October 30, TRM tallied around $2.7 billion in frozen assets, including roughly 1.77 billion USDT locked by Tether and about 825 million USDC locked by Circle.
Ripple and World Liberty Financial froze smaller amounts, and Arbitrum’s Security Council used its emergency powers to move about $30 million out of an attacker wallet. Binance estimates the frozen total at roughly $3 billion.
To stay ahead of the issuers, the attackers sold USDT for ETH at more than 10% below market price. TRM says they still hold over 420,000 ETH and 18,270 BTC, about $2.4 billion in assets that no issuer can freeze.
Related: $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
Related: Crypto Scammers Hijack Microsoft’s Official X Account
Related: North Korea Suspected in $351 Million Bitget Crypto Heist
