← Articles and guides on fraud, cybersecurity, privacy and AML
Binance hack: $6.3B theft tied to North Korea, what we know
The $6.36B Binance hack, the largest crypto theft on record: how it happened, what was frozen, why North Korea is blamed and what users should do now.
On October 29, 2026, about $6.36 billion in crypto left Binance wallets on ten blockchains, most of it in roughly 20 minutes starting at 20:05 UTC, according to TRM Labs. It is the largest crypto theft on record, about four times the February 2025 Bybit hack. TRM, Chainalysis and Elliptic link it to North Korea.
How did the Binance hack happen?
TRM says the attacker used EIP-7702 to turn an Ethereum hot wallet into a sweeper it controlled, using one of 50 pre-signed authorizations. A single transaction then moved 167,464 ETH and 63 tokens, including 1.615 billion USDT. On nine other chains, Binance wallets sent funds through ordinary signed transfers, so TRM assesses the hot-wallet signing infrastructure was compromised. Binance's initial probe points to a compromised engineer's laptop that gave access to a service container able to submit withdrawals, per TechCrunch; Binance says it found no evidence of private-key leakage. CBS News reports a later review found more than one point of breach.
How much was stolen and how much is frozen?
| Item | Figure |
|---|---|
| Total moved (TRM) | ~$6.36B across 10 chains |
| Ethereum | ~$3.79B |
| Bitcoin | 18,270 BTC (~$1.47B) |
| Frozen as of 00:30 UTC Oct 30 (TRM) | ~$2.7B (Tether ~1.77B USDT, Circle ~825M USDC) |
| Still with attacker (TRM) | ~$2.4B, incl. 420,000+ ETH |
The breakdown by chain, per TRM, also includes 612.7 million USDT and 46.4 million TRX on Tron (about $628 million), 233.46 million XRP (about $296 million) and 970,500 SOL (about $96 million). Preparation began at least 36 hours earlier, with small Tornado Cash withdrawals to an operator wallet starting October 28. The attacker kept sweeping fresh deposits into the compromised wallet several times until close to midnight UTC.
Stablecoin issuers made the difference. Because Tether, Circle, Ripple and others can freeze tokens at specific addresses, almost half of the haul was locked within hours. Ether and bitcoin cannot be frozen that way, which is why the attacker quickly used lending protocols to borrow ETH against stablecoins before freezes landed.
Binance later cited about $3 billion frozen with partners, according to Forbes. TRM describes laundering through discounted USDT-to-ETH swaps, lending protocols such as Aave and JustLend, and a bitcoin peel chain, with bridges and OTC brokers expected next.
Why is North Korea blamed?
TRM attributes the attack with "high confidence" to TraderTraitor; Chainalysis CEO Jonathan Levin told CBS it was likely the same group, and Elliptic also pointed to North Korea. The FBI has not commented on Binance, but its February 2025 PSA blamed TraderTraitor for the roughly $1.5 billion Bybit theft. Chainalysis, as reported by The Record, says North Korea stole at least $2.02 billion in 2025 and $6.75 billion since 2022.
Will Binance users lose money?
Binance says it will cover all losses with its SAFU fund and company funds, resume withdrawals in phases after security checks, and publish updated proof of reserves, per Forbes. Independent proof was not yet available at publication.
What does it mean for exchange users?
Three lessons stand out. Exchange security depends on people and workstations as much as on cryptography: the reported entry point was a laptop. Single signatures and never-expiring approvals on hot wallets widen the damage, a point raised by an analyst quoted by CBS. And freezes only work on assets whose issuers can freeze them. Large incidents also trigger waves of phishing that impersonate the victim company, so treat any message about "refunds" or "verification" with suspicion.
What to do
- Ignore "Binance" messages asking you to log in or "recover funds"; use only the official app.
- Keep on exchanges only what you trade; enable passkeys, withdrawal allowlists and login alerts.
- Report related scams to the FBI IC3.
More: crypto dashboard, incident radar, money laundering, pig butchering explained.