TRM Research Report: How North Korean Hackers Stole $6.36 Billion from Binance Overnight, With About $2.4 Billion Still Unfrozen
Author: TRM Team
Compiled by: TechFlow
TechFlow Digest: This is the first comprehensive breakdown from on-chain forensics firm TRM Labs on the Binance theft: high-confidence attribution to the North Korean hacking group TraderTraitor, pointing out that ten chains simultaneously saw “legally signed” outgoing transfers within half an hour, indicating the core issue likely lies in Binance’s hot wallet signing system itself rather than being solely a phishing incident. For investors, the real uncertainty doesn’t lie with the approximately $2.7 billion in stablecoins already frozen, but in the fate of the ~420,000 ETH and 18,270 BTC currently controlled by the attacker—this inventory will next be liquidated via cross-chain bridges, exchange platforms, and OTC channels, representing the potential sell-side pressure on ETH and BTC.
Key Takeaways
On October 29, 2026, an attacker drained approximately $6.36 billion from Binance wallets across ten blockchains, with most of the funds moved in roughly 20 minutes starting at 20:05 UTC. This makes it the largest cryptocurrency theft on record, roughly four times the size of the $1.5 billion Bybit heist in February 2025. Binance has confirmed a security incident and temporarily halted withdrawals across multiple networks.
Based on reliable on-chain and off-chain intelligence, TRM attributes this attack to TraderTraitor, North Korea’s elite hacker unit. We hold a high level of confidence in this assessment. TRM is actively tracking these funds and issuing warnings to partners via the Beacon Network.
On Ethereum, the attacker leveraged an EIP-7702 delegation to turn a Binance hot wallet into a “sweeper” under their control, having prepared 50 pre-signed authorizations in advance. Within the same time window, Binance wallets on the other nine chains also transferred funds to the attacker via standard signature transactions. TRM assesses that this points to a compromise of Binance’s hot wallet signing infrastructure.
Tether, Circle, Ripple, and World Liberty Financial have frozen approximately $2.67 billion in stablecoins, while the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB on its network, totaling roughly $2.7 billion. The attacker raced against the freeze operations: selling USDT to market makers and borrowing ETH against USDT collateral on Aave. It currently holds over 420,000 ETH and 18,270 BTC, meaning approximately $2.4 billion in assets remains beyond the reach of any issuer.
Timeline of Events
In the evening of October 29, wallets belonging to the world’s largest cryptocurrency exchange, Binance, began draining billions in crypto assets. Within just minutes, Binance wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana, and four additional networks transferred their balances to addresses controlled by the same attacker. A second wave of transfers around 23:05 UTC affected Binance’s wallets on Avalanche and Polygon.
Binance stated it is investigating a potential security issue, later clarifying that it had temporarily paused withdrawals across several networks as a precaution. The exchange assured users that their funds are safe. The situation is still developing; data in this report reflects on-chain observations made by TRM as of 00:30 UTC on October 30.
Attribution
TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. Our assessment is based on reliable on-chain and off-chain intelligence sources. The FBI previously identified this group as responsible for the $1.5 billion Bybit theft in February 2025. Several characteristics of this attack align with previous North Korea-linked heists, including the Bybit case and the April 2026 KelpDAO breach: funding operational wallets with small withdrawals from Tornado Cash, setting up well in advance of the theft, obtaining signatures beforehand, and executing them in a concentrated batch. However, the money laundering methods observed so far—large-scale swaps through market makers and lending protocols—differ from the cross-chain bridge-heavy pattern following the Bybit incident. As the investigation progresses, TRM will share further findings.
Amount Stolen
TRM has tracked every transfer moving from Binance-owned wallets to addresses controlled by the attacker across ten blockchains. Valued at the prices when each asset was transferred, the total is approximately $6.36 billion. At current prices, these identical assets are worth roughly $6.23 billion.
Ethereum accounts for approximately $3.79 billion, comprising 200,630 ETH alongside 185 other tokens, including 1.875 billion USDT, 823 million USDC, and 88.5 million RLUSD. Bitcoin outflows totaled 18,270 BTC, valued at roughly $1.47 billion. Tron outflows included 612.7 million USDT and 46.4 million TRX, totaling approximately $628 million. The XRP Ledger lost 233.46 million XRP, worth about $296 million. Solana saw outflows of 970,500 SOL, approximately $96 million. Arbitrum, Optimism, and Base combined for roughly $39 million, which includes 74.6 million ARB stolen on Arbitrum. Avalanche outflows reached about $28 million, and Polygon outflows hit approximately $10 million.
How the Attack Unfolded
Preparations began at least 36 hours before the theft. Starting on the morning of October 28, the attacker’s operational wallets received three separate small withdrawals from Tornado Cash, a service used to obscure the origin of crypto assets. In the early hours of October 29, the operator deployed the initial attack code and tested it on two wallets. Later that day, they rehearsed the final version on a third wallet and transferred the test funds back to themselves. Four hours after this rehearsal concluded, the same code was installed on a Binance hot wallet.
The first theft of the night occurred on the XRP Ledger. Between 20:05 and 20:09 UTC, five Binance wallets transferred 233.46 million XRP to a single attacker address, leaving only the minimum required balance in each. These XRP have not moved since. Just past 20:10 UTC, Binance’s wallets on Solana and Optimism followed suit. At 20:20, a Binance Bitcoin hot wallet sent 18,270 BTC to the attacker’s address, which immediately began splitting the funds into integer chunks of 1,000 BTC and 100 BTC within the same block. This technique, known as a “peel chain,” makes fund tracing significantly harder. In less than two minutes, a Binance Tron hot wallet forwarded 612.7 million USDT and 46.4 million TRX to the attacker.
How the Attacker Took Over the Binance Hot Wallet
Hot wallets are online wallets used by exchanges to process customer withdrawals. The Ethereum hot wallet involved in this case is one of Binance’s most well-known addresses.
Introduced with Ethereum’s Pectra upgrade in May 2025, EIP-7702 allows a standard wallet to delegate its behavior to a smart contract by signing an authorization. From then on, every interaction with that wallet will execute the contract’s code, and this arrangement remains in effect until the wallet signs a new authorization.
At 20:20 UTC, the operator submitted a transaction containing 50 authorizations. Each was signed by the Binance hot wallet and pointed to a sweeper contract that only accepts commands from the operator. Every wallet maintains a continuous count of transactions it sends, known as a nonce. An authorization is only valid if it matches the wallet’s current nonce at the moment of execution. Because this Binance hot wallet continuously processed incoming withdrawals, its nonce kept incrementing. By pre-generating signatures for 50 consecutive nonces, the attacker ensured that at least one signature would remain valid when a transaction went through. One matched, which was all the attacker needed. These signatures were generated in a batch ahead of time.
Three minutes and 24 seconds after the delegation took effect, the operator directed the Binance hot wallet to transfer its entire balance to an attacker-controlled address. This single transaction drained 167,464 ETH and 63 different tokens, including 1.615 billion USDT.
The delegation was never revoked. Whenever new funds entered this Binance hot wallet, the operator swept them away again at 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56 UTC. The wallet also served as the executor for another Binance smart account, allowing the attacker to withdraw 823 million USDC from it. Circle quickly froze these USDC shortly afterward.
Evidence Points to Binance’s Signing Infrastructure
Early indicators of activity on Ethereum suggested the attacker may have phished these authorizations. However, this explanation only covers the Ethereum scenario and cannot account for the other chains. Within the same time window, five Binance wallets on the XRP Ledger, wallets on Arbitrum, Avalanche, Optimism, and Base, a Bitcoin hot wallet, a Tron hot wallet, and a Solana wallet all transferred funds to the attacker via standard signature transactions. Another Binance Ethereum hot wallet similarly moved 28,006 ETH, 55.7 million USDT, and 25.9 million RLUSD without any delegation involved. Approximately two and a half hours later, at 23:05 UTC, Binance’s wallets on Avalanche and Polygon followed suit.
These wallets operate across different chains, utilizing distinct key types and signature schemes. Yet, all of them successfully generated valid signatures for the attacker within roughly half an hour. TRM assesses that the most plausible explanation is that the attacker gained the ability to compel Binance’s hot wallet signing system to co-sign transactions across chains according to their intent. The batch of 50 pre-signed authorizations suggests this access may have been time-bound, or signatures required approval through a centralized system. Binance has not yet disclosed the root cause.
Stablecoin Freezes and Asset Conversion
Stablecoin issuers acted swiftly, with freeze operations expanding throughout the night. At 23:35 UTC, Binance reported that verified freezes totaled $2.54 billion. Accounting for subsequent freezes, as of 00:30 UTC, TRM estimates on-chain frozen amounts at approximately $2.7 billion:
Tether, ~1.77 billion USDT. Tether froze 971.1 million USDT in the primary receiving wallet at 21:01 UTC, just 37 minutes after the main sweep. Subsequent swept funds fell into this already-frozen wallet, which currently holds 1.175 billion USDT. Tether also froze 205 million USDT in two additional attacker wallets on Ethereum, 378.7 million USDT across two attacker wallets on Tron, and 8.4 million USDt on Avalanche. Additionally, 6.2 million USDT on Polygon has been frozen.
Circle, ~825 million USDC. Collaborating with law enforcement at 21:04 UTC, Circle froze 823 million USDC in the main receiving wallet. They subsequently froze 1.56 million USDC that the attacker had swapped for AVAX and bridged from Avalanche to Ethereum.
Ripple, 40.5 million RLUSD. At 22:01 UTC, Ripple froze the wallet holding the stolen RLUSD, which still contained 40.5 million of the originally stolen 88.5 million. Ripple also froze the RLUSD in the compromised Binance hot wallet, preventing newly deposited funds from being swept. Binance Co-CEO He Yi stated that Ripple helped halt the transfer of approximately $200 million in funds; TRM has on-chain confirmed the freeze of 40.5 million RLUSD.
World Liberty Financial, 27.8 million USD1. WLF froze 27.8 million USD1 in the primary receiving wallet at 22:10 UTC, and at 22:26 UTC froze the USD1 held in the breached Binance hot wallet.
Arbitrum Security Council, 8,426 ETH and 74.6 million ARB. The Arbitrum Security Council is a body empowered to take emergency actions on the network. At 00:08 UTC, it exercised these powers to forcibly execute two transfers from the attacker’s Arbitrum wallets, removing 8,426 ETH and 74.6 million ARB (worth roughly $30 million) from the attacker’s control.
During the initial hours, the attacker incurred steep costs to swap freelyzable stablecoins into assets beyond the reach of any issuer. Approximately 325 million USDT was sold to professional execution agents and market makers via UniswapX and other intent-based contracts, fetching roughly 122,300 ETH. This implies an execution price nearing $2,650 per ETH, compared to the prevailing market price of $2,300–$2,350 at the time—a discount exceeding 10%. The remaining 175 million USDT from this batch was subsequently frozen.
The attacker’s secondary wallet deposited 60 million USDT into the lending protocol Aave, using it as collateral to borrow approximately 19,760 ETH, prompting Aave to freeze the affected markets. On Tron, 300 million USDT was routed to a wallet that began depositing these funds into the lending protocol JustLend. An additional 200 million USDT was swapped on Uniswap through a series of hop wallets, along which route 30 million USDT was frozen. Following two hops, 88.5 million RLUSD entered a wallet, where 48 million was sold via decentralized exchanges between 21:42 and 22:01 UTC, until Ripple froze the remaining 40.5 million.
As ETH consolidated into a few wallets and 18,270 BTC flowed along the peel chain, the attacker controls approximately $2.4 billion in assets inaccessible to any issuer. Drawing from past major heists, TRM anticipates that the next phase will involve cross-chain bridges, exchange platforms, and over-the-counter (OTC) brokers. TRM is monitoring each output address on the peel chain and associated aggregation wallets to track these movements.
Action Items for Exchanges and Compliance Teams
Exchanges and compliance teams should screen deposits and counterparties against TRM’s flagged attacker addresses. Funds originating from the Bitcoin peel chain and ETH aggregation wallets are highly likely to flow into exchanges, exchange platforms, and OTC desks within the coming days.
Treasury management teams should monitor compatible Ethereum wallets for EIP-7702 delegations—manifesting as code appearing on addresses that should normally contain none. Any such delegation on a treasury wallet must trigger immediate alerts. Teams should prepare a tested, pre-approved method for revoking signatures.
Signing policies should reject unauthorized EIP-7702 approvals. Requesting a large volume of authorizations spanning a range of transaction counts should be treated as a sign of compromise. Signing infrastructure and approval workflows must be isolated across chain and wallet tiers. In this incident, a single actor obtained valid signatures for wallets across ten blockchains within a few hours.
Market makers and solvers should screen counterparties prior to executing large orders. Approximately 325 million USDT was sold to market makers and solvers by a wallet that had only received those USDT from the hackers minutes earlier. Real-time address screening could have flagged this.
Frequently Asked Questions
What happened at Binance?
On October 29, 2026, an attacker drained approximately $6.36 billion from Binance wallets across ten blockchains: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon. Binance has confirmed a security incident and paused withdrawals on multiple networks.
Who is behind the Binance heist?
Based on reliable on-chain and off-chain intelligence, TRM attributes the Binance theft to the state-sponsored North Korean hacking group TraderTraitor. This same group was also responsible for the $1.5 billion Bybit heist in February 2025.
What is EIP-7702, and how was it exploited?
EIP-7702 enables a standard Ethereum wallet to authorize a smart contract to execute code on its behalf. The attacker leveraged a pre-signed authorization to make the Binance hot wallet execute a sweeper contract callable only by them, draining the wallet entirely and repeatedly sweeping newly deposited funds.
How much of the stolen crypto has been frozen?
Tether, Circle, Ripple, and World Liberty Financial have frozen approximately $2.67 billion in stablecoins, while the Arbitrum Security Council froze roughly $30 million worth of ETH and ARB, bringing the total to around $2.7 billion. The attacker still controls over 420,000 ETH and 18,270 BTC, valued at approximately $2.4 billion, alongside smaller amounts of assets on other chains.
How does this compare to other major hacks?
Valued at roughly $6.36 billion, it stands as the largest cryptocurrency theft on record, approximately four times the scale of the $1.5 billion Bybit hack in February 2025. Even excluding the frozen stablecoins, the attacker’s currently retained holdings surpass any previous heist.