North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History - TRM Labs
On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets across ten blockchains, with most of it transferred in about 20 minutes starting at 20:05 UTC.
The breach represents the largest cryptocurrency theft on record, approximately four times the USD 1.5 billion Bybit hack of February 2025. Binance quickly responded by suspending withdrawals on multiple networks while assuring customers that their funds remain secure. The incident occurred across ten different blockchains, including Ethereum, Bitcoin, Tron, Solana, and others.
According to TRM Labs, which attributes the attack to North Korea's elite hacking unit TraderTraitor with high confidence, the attacker utilized sophisticated techniques. On Ethereum, the attacker employed an EIP-7702 delegation to transform a Binance hot wallet into a controlled sweeper, utilizing 50 pre-signed authorizations prepared in advance.
Attack Methodology
Preparation for the theft began at least 36 hours prior, with the attacker's operator wallet receiving small withdrawals from Tornado Cash, a service that obscures transaction origins. The attacker rehearsed the attack on test wallets before executing the final version on Binance's infrastructure.
The first theft occurred on the XRP Ledger between 20:05 and 20:09 UTC, with five Binance wallets transferring 233.46 million XRP to a single attacker address. Similar transfers followed on other chains, including Bitcoin, where the attacker used a 'peel chain' technique to split 18,270 BTC into smaller, harder-to-trace pieces.
Industry Response
Stablecoin issuers acted swiftly to freeze stolen funds. Tether, Circle, Ripple, and World Liberty Financial collectively froze approximately USD 2.67 billion in stablecoins. Arbitrum's Security Council additionally froze 8,426 ETH and 74.6 million ARB, bringing the total frozen amount to roughly USD 2.7 billion.
The attacker attempted to circumvent these freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. Despite these efforts, the attacker now holds more than 420,000 ETH and 18,270 BTC, representing about USD 2.4 billion in assets beyond the reach of issuers.
North Korean Connection
TRM Labs attributes the attack to TraderTraitor, North Korea's premier hacking unit, based on robust on-chain and off-chain intelligence. The FBI previously named the same group as responsible for the USD 1.5 billion Bybit hack in February 2025.
Several features of this attack match earlier North Korea-linked heists, including small Tornado Cash withdrawals funding an operator wallet and staging that began well before the theft. The laundering pattern observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed the Bybit hack.
Related
