North Korean Hackers Steal $6.36 Billion From Binance in Largest Crypto Heist

North Korean hacking group TraderTraitor stole approximately $6.36 billion from Binance across 10 blockchains on Oct. 29, according to TRM Labs ⁸. The incident is the largest crypto theft on record, totaling roughly four times the $1.5 billion Bybit exploit in February 2025 ⁸.

Binance confirmed a security incident and temporarily suspended withdrawals on multiple networks as a precaution ⁸. According to TRM Labs, the perpetrators compromised Binance's hot wallet signing infrastructure, allowing them to execute unauthorized transactions across multiple networks ⁸. The attackers used an EIP-7702 delegation on Ethereum to gain control of a Binance hot wallet ⁸.

The Extraction Process

According to TRM Labs, preparation for the attack began at least 36 hours before the theft ⁸. The attacker's operator wallet received initial funds from Tornado Cash on Oct. 28 ⁸.

Between 20:05 and 20:09 UTC on Oct. 29, five Binance wallets on the XRP Ledger sent 233.46 million XRP to an attacker address ⁸. Withdrawals from Solana and Optimism followed ⁸. At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to the attacker, while a Tron hot wallet sent 612.7 million USDT and 46.4 million TRX within two minutes ⁸.

On Ethereum, the attackers submitted a transaction with 50 authorizations, pointing the hot wallet to a sweeper contract ⁸. Shortly after, a single transaction moved 167,464 ETH and 63 tokens ⁸. The attacker swept new funds as they arrived over the next several hours ⁸. They also pulled 823 million USDC from a separate smart account ⁸. Standard signed transfers were used on chains other than Ethereum ⁸. Binance wallets on Avalanche and Polygon were emptied later in the evening ⁸.

Unfrozen Assets Total $2.4 Billion

The stolen assets included 200,630 ETH, 1.875 billion USDT, 823 million USDC, 88.5 million RLUSD, 18,270 BTC, 612.7 million USDT on Tron, 46.4 million TRX, 233.46 million XRP, 970,500 SOL, and 74.6 million ARB ⁸.

Stablecoin issuers and network security councils acted quickly to freeze assets ⁸. Tether, Circle, Ripple, and World Liberty Financial froze about $2.67 billion in stablecoins ⁸. The Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB ⁸. In total, approximately $2.7 billion has been frozen onchain ⁸.

The attackers sold USDT to market makers and borrowed ETH against USDT on Aave ⁸. They currently hold over 420,000 ETH and 18,270 BTC, valued at roughly $2.4 billion, which remains beyond the reach of issuers ⁸.

The Recovery Effort

Binance estimates the financial impact at $6.3 billion ⁶. The exchange expects to begin resuming withdrawals within 48 hours ⁷. Binance executive Yi He stated that deposits are operating normally and pledged to cover losses ⁷. The company reported that about $3 billion in affected assets has been frozen onchain ⁴⁶. Binance CEO Richard Teng said the breach was not a "one-click" attack ⁴.

A wallet linked to the exploit moved 14,040 ETH to a new holding address ⁵. Two large tracked wallets continue to hold 197,460 ETH and 137,602 ETH, while the new recipient holds about 19,740 ETH ⁵. The USDT0 network froze 6.19 million tokens linked to the exploit and restored transfers between Tron and Ethereum following a precautionary pause ³.

Regional Market Context

The attack occurred against a backdrop of varying crypto activity in East Asia ¹. South Korea leads the region with a $449.1 billion crypto economy, driven largely by retail investment in AI cryptocurrencies like Worldcoin and SAHARA ¹. Japan's crypto economy, valued at $228.3 billion, sees substantial institutional activity and increasing decentralized exchange usage ¹.

Chainalysis recently used in-house AI tools to trace $387 million stolen from Bitget by North Korean threat actors in September 2026 ². The total value of cryptocurrency stolen by North Korean actors in 2026 has surpassed $1 billion, excluding the recent Binance exploit ².