TRM Labs Attributes $6.36B Binance Drain to North Korea's TraderTraitor

North Korea’s elite cyber group TraderTraitor was responsible for the theft of roughly $6.36 billion from Binance wallets across 10 blockchains on Oct. 29, according to blockchain intelligence firm TRM Labs ¹. The exploit marks the largest single cryptocurrency theft on record, moving the majority of the funds within roughly 20 minutes beginning at 20:05 UTC ¹. Binance previously confirmed a security incident, announced a temporary suspension of withdrawals across several networks, and stated that user funds remain safe ¹.

According to TRM Labs, the breach involved a compromise of Binance’s cross-chain hot wallet signing infrastructure, enabling the attacker to produce valid transfer signatures across disparate networks ¹. On Ethereum, the attacker leveraged an EIP-7702 delegation with 50 pre-signed authorizations prepared in advance to convert a prominent Binance hot wallet into an attacker-controlled sweeper ¹. Outflows spanned multiple networks, including approximately $3.79 billion from Ethereum, $1.47 billion in $BTC from Bitcoin, $628 million from Tron, and $296 million from the XRP Ledger ¹.

Issuers Freeze Billions as Attacker Converts Assets

Issuers and networks reacted swiftly, freezing an estimated $2.7 billion in digital assets across affected blockchains as of Oct. 30 at 00:30 UTC ¹. Tether, Circle, Ripple, and World Liberty Financial halted around $2.67 billion in stablecoins, including roughly 1.77 billion $USDT frozen by Tether, while the Arbitrum Security Council locked 8,426 ETH and 74.6 million ARB ¹.

Despite the coordinated intervention, TRM Labs reported that the attacker raced against freezes by swapping USDT with market makers and borrowing ETH against stablecoins on Aave ¹. The hacker retained control of more than 420,000 ETH and 18,270 BTC—totaling roughly $2.4 billion in unfreezable baseline assets ¹. Bitcoin peel chains were deployed immediately within transaction blocks to split outflows into smaller increments and hinder tracking ¹. At the time of writing, broader crypto markets reflected mounting caution, with the Fear & Greed Index registering 30.