Hacker Stole $6.3 Billion from Binance in Crypto's Largest-Ever Hack

North Korean state hackers stole approximately $6.3 billion from Binance's hot wallets across ten blockchains on October 29, 2026 — the largest theft from a financial institution in history, exceeding the previous cryptocurrency record by more than four times. The attack was attributed with high confidence to the Pyongyang-linked TraderTraitor unit by TRM Labs and Chainalysis, and exploited a vulnerability in Ethereum's account-abstraction standard and, according to blockchain forensics investigators, likely required direct access to the centralized signing infrastructure that Binance used to process withdrawals across multiple blockchains simultaneously. The FBI said it is engaged with relevant public and private partners in response to the incident. Binance CEO Richard Teng confirmed the theft and pledged $6.34 billion in combined SAFU fund and corporate reserves to cover user losses; Binance said withdrawals were expected to resume within approximately 48 hours.

How Attackers Drained Ten Blockchains in Under Twenty Minutes

The attack did not begin on October 29. On approximately October 28, more than 36 hours before the theft, the attackers funded a set of operator wallets through Tornado Cash — the OFAC-sanctioned Ethereum mixer — establishing the operational infrastructure they would need to rapidly route stolen funds. The details below are drawn from the TRM Labs forensic post-mortem published within hours of the breach.

The technical execution began at 20:05 UTC when the XRP Ledger hot wallet was drained of 233.46 million XRP. Within five minutes, Solana (970,500 SOL) and Optimism wallets were emptied. By 20:20 UTC, the attack had spread to Bitcoin (18,270 BTC), Tron (612.7 million USDT and 46.4 million TRX), and Ethereum — where a mechanism specific to Ethereum's newest protocol upgrade came into play.

EIP-7702, introduced with the Ethereum Pectra upgrade in May 2025, allows a standard user wallet (an externally owned account, or EOA) to temporarily delegate its transaction execution to an attacker-controlled smart contract by signing a short authorization message. That authorization message contains just three values: the chain ID, the target contract address, and the wallet's current nonce — the sequential transaction counter that increments each time the wallet sends a transaction.

The attackers pre-signed 50 such authorization messages, each targeting a different consecutive nonce value. Binance's Ethereum hot wallet processes withdrawal traffic continuously, meaning its nonce increments constantly. One of the 50 pre-signed authorizations was mathematically guaranteed to match the live nonce eventually — no further social engineering, credential theft, or code injection required once those messages existed. When the match occurred, the authorization installed an attacker-controlled sweeper contract that drained 200,630 ETH and 185 ERC-20 tokens.

What made the Binance attack categorically different from previous exchange hacks is what happened across the other nine chains in the same 20-minute window. Producing valid cryptographic signatures for XRP Ledger, Solana, Bitcoin, Tron, Optimism, Arbitrum, Avalanche, Polygon, and Base within that window requires access to different key types — secp256k1 for Bitcoin and Ethereum, Ed25519 for Solana, and various others depending on the chain. No phishing attack against a single user, no smart contract exploit on a single chain, and no browser-based injection produces that result simultaneously. TRM Labs assessed with high confidence that the attacker compromised Binance's centralized signing backend — the shared infrastructure that generated cryptographic signatures for all of these chains in a single operational system.

Binance's preliminary internal finding identified the initial access vector as a compromise of a developer or DevOps engineer's laptop. How signing keys were subsequently extracted from that access point has not yet been publicly confirmed.

Stablecoin Issuers Froze $2.7 Billion Before Attackers Could Convert It All

The 20 minutes between attack start and detection triggered a separate race: stablecoin issuers have administrative freeze controls over tokens held at specific blockchain addresses, and activating those controls before attackers convert freezeable tokens into non-freezeable assets (ETH, BTC, SOL) is the practical difference between recovering billions and recovering nothing.

According to TRM Labs, Tether froze approximately $1.77 billion in USDT across Ethereum and Tron. Circle froze approximately $825 million in USDC. Ripple activated a freeze on $40.5 million in RLUSD. World Liberty Financial froze $27.8 million in USD1. Arbitrum's Security Council froze roughly $30 million held in Arbitrum addresses. Combined, approximately $2.7 billion was rendered unspendable within hours of the theft — without a court order, regulatory direction, or formal coordination mechanism between the issuers.

The attackers anticipated partial freezing. Before stablecoin issuers could act, the hackers began selling stolen USDT at discounts exceeding 10 percent to unidentified market makers to convert positions into non-freezeable assets — a technique TRM Labs observed on-chain. The hackers also used Aave, a decentralized lending protocol, to borrow ETH against stolen collateral, acquiring assets that cannot be frozen by any stablecoin issuer.

Approximately $2.4 billion — primarily 420,000-plus ETH and the full 18,270 BTC position — remained in attacker-controlled addresses actively cycling as of the time of reporting. The Bitcoin is being peel-chained: a technique in which large UTXOs are repeatedly split across many new addresses in round lots (TRM Labs observed 1,000 BTC and 100 BTC pieces) to fragment the transaction graph and complicate tracing.

The stablecoin freeze result surfaces a structural reality the crypto industry rarely acknowledges: practical resilience against catastrophic theft depends on five private companies choosing to activate administrative controls on short notice, with no formal legal process. The decentralized infrastructure beneath those tokens depends, in crisis, on the most centralized emergency response possible.

TraderTraitor's Escalating Campaign Against Centralized Exchanges

The Binance attack is not an isolated incident. It is the fourth major exchange theft attributed to TraderTraitor — the North Korean state-sponsored advanced persistent threat unit also identified as UNC4736 by Mandiant and tracked under the Lazarus Group umbrella — in under two years, and each successive attack has been larger and more technically sophisticated than the last.

In February 2025, TraderTraitor stole $1.5 billion from Bybit by injecting malicious code into the web interface of Safe, a popular smart contract wallet management platform. That attack operated at the user-interface layer: Bybit's signers approved transactions they believed were legitimate but which had been invisibly replaced by attacker-controlled transfers. The signing infrastructure itself was not compromised; the attackers manipulated what signers saw and approved.

The Binance attack operates at a fundamentally different layer. If TRM Labs's signing-infrastructure assessment is correct, the attackers bypassed the human approval layer entirely and produced valid signatures directly from the backend system. This represents a capability escalation from front-end manipulation to infrastructure compromise — a shift that implies either significant improvement in operational capability or a previously unknown insider access vector. Chainalysis documented on-chain commingling between funds from the September 2026 Bitget theft ($387 million, also attributed to TraderTraitor) and the Binance theft — the most direct blockchain evidence linking the two operations to the same actor.

U.S. Treasury assessments have consistently linked TraderTraitor theft proceeds to North Korea's ballistic missile and nuclear weapons development programs. At $6.3 billion, this single theft represents a meaningful fraction of estimated annual North Korean state revenues from all sources.

Automated Laundering at a Scale the Industry Has Not Previously Seen

The laundering operation accompanying the theft is as significant as the theft itself. Chainalysis noted in its published analysis that the Binance laundering exhibited never-before-seen patterns consistent with fully automated scripted orchestration.

The specific indicator: thousands of new blockchain addresses each received exactly one TRX — a negligible amount of Tron's native currency — before receiving stolen funds. Seeding fresh addresses with a minimal native-currency balance is a known technique for ensuring that transactions have the network gas to execute; doing it at this volume and this speed, in scripted sequence, before funds arrive, indicates infrastructure built specifically for post-theft laundering at exchange scale.

The ETH and BTC positions in attacker-controlled addresses are still moving. The peel-chain technique applied to the Bitcoin tranche splits custody across so many addresses that standard blockchain surveillance tools face significant resource costs to maintain continuous tracking. Whether the international blockchain forensics community and the exchanges holding potential off-ramp points can coordinate faster than the laundering infrastructure cycles through addresses will determine how much, if any, of the $2.4 billion at large is recoverable.

Separately, market makers who purchased stolen USDT at a discount before freeze operations may face OFAC secondary sanctions exposure: transacting with proceeds attributable to North Korean state actors, even unknowingly, falls within the sanctions frameworks applied to TraderTraitor-linked funds. Their identities are not public.

SAFU, Market Impact, and the Architectural Question the Industry Cannot Defer

Within hours of the theft confirmation, Bitcoin fell 4.1 percent to approximately $77,445. Ethereum dropped 4.4 percent. BNB, Binance's native exchange token, declined 6 percent. Approximately $1.57 billion in cryptocurrency derivatives positions were liquidated in the 12 hours following the attack, according to CoinGlass.

Binance's Secure Asset Fund for Users, established in 2018 from 10 percent of trading fees and converted to roughly $1.27 billion in Bitcoin earlier in 2026, represents the exchange's primary insurance mechanism. Combined with stated corporate reserves, Binance pledged total coverage of $6.34 billion — essentially matching the theft figure. Whether that pledge is fully backed by immediately liquid assets, and whether it covers all affected users without conditions, remains unverified from independent sources.

U.S., European, and South Korean regulators were requesting incident reports within 24 hours of the breach. Binance, which has operated under enhanced regulatory scrutiny since its $4.3 billion U.S. Department of Justice settlement in November 2023, faces a more constrained regulatory posture than at any prior point in its history. CZ's departure, combined with a subsequent major breach, creates a compliance narrative that some regulators will use as grounds to accelerate demands for independent hot wallet infrastructure audits.

The core technical question this attack forces is one the exchange industry has avoided making explicit: centralized signing backends that serve multiple blockchains simultaneously are, by construction, a single point of catastrophic failure. Alternative architectures exist. Multi-party computation distributes signing across multiple independent parties, requiring simultaneous compromise of several systems to produce a valid signature. Hardware security modules enforce signing logic in tamper-resistant hardware, limiting what any software-level compromise can access. Per-chain key isolation prevents a breach on one chain from propagating to others. Each of these approaches carries real operational cost. The Bybit hack's $1.5 billion in losses did not produce industry-wide architectural change. The question is whether $6.3 billion will.

The next watchable milestone is not the withdrawal resumption Binance has scheduled for approximately November 1 — it is what TRM Labs, Chainalysis, and Binance's own forensics team determine about the exact initial access path into the signing infrastructure. If that analysis confirms a supply-chain or insider vector rather than a standard credential attack, the threat model for every major exchange's signing backend changes, and no off-the-shelf security certification will have covered it.