Binance suffered the largest cryptocurrency theft on record after an attacker transferred approximately US$6.36 billion from its wallets across 10 blockchain networks on October 29, 2026, according to blockchain intelligence firm TRM Labs. The company initially estimated the incident's financial impact at US$6.3 billion and suspended withdrawals while investigating multiple security breaches. TRM attributes the attack to North Korea-linked hacking group TraderTraitor, while Binance has committed more than US$6.34 billion in resources to cover affected balances.
Binance, the world's largest cryptocurrency exchange by trading volume, suffered a security breach that resulted in approximately US$6.36 billion in unauthorized transfers, marking the largest cryptocurrency theft on record. The October 29 incident affected wallets across multiple blockchain networks, prompting the exchange to suspend withdrawals while coordinating with security firms, law enforcement agencies, and cryptocurrency issuers to contain the attack.
The scale of the breach exceeds the US$1.5 billion stolen from cryptocurrency exchange Bybit in February 2025 by more than four times. Binance has committed to covering all affected balances through its corporate resources and its Secure Asset Fund for Users (SAFU), while blockchain investigators attribute the attack to TraderTraitor, a North Korean state-sponsored hacking group.
The incident also exposed vulnerabilities in the infrastructure exchanges use to authorize transactions, raising questions about how attackers can compromise operational systems without necessarily obtaining direct access to private wallet keys.
Binance initially estimated the financial impact at approximately US$6.3 billion. However, TRM Labs, a blockchain intelligence company, traced approximately US$6.36 billion in transfers from Binance-attributed wallets across 10 blockchain networks: Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon.
According to TRM, most of the assets moved within approximately 20 minutes, beginning at 20:05 UTC on October 29. A second wave of transactions affected additional wallets later that evening.
Richard Teng, Co-CEO of Binance, said the company's initial investigation indicated that a compromised DevOps engineer's laptop might have provided an attacker with access to an internal service container, allowing unauthorized withdrawal transactions.
However, the investigation subsequently uncovered additional points of breach. In a video statement reported by CoinDesk on October 30, Teng explained that attackers had also used a self-destruct mechanism to erase evidence and exploited Ethereum's EIP-7702 account-delegation feature to take control of a hot wallet without following Binance's normal approval procedures.
"This was a complex attack," Teng said, adding that investigators had yet to establish the complete sequence of events.
Binance has maintained that it found no evidence of a wallet private key leak. The exchange has also not attributed responsibility to an individual employee. Binance.com was affected, while Binance.US, its separate platform serving US residents, reported no impact.
TraderTraitor and the Compromise of Transaction Infrastructure
TRM Labs attributes the attack to TraderTraitor, a North Korean state-sponsored hacking unit, with high confidence based on on-chain transactions and off-chain intelligence. The assessment draws on similarities with previous operations associated with the group, including the February 2025 Bybit hack.
Blockchain analytics firm Chainalysis has also identified TraderTraitor as a likely perpetrator, while security researchers have identified similarities in the attackers' preparation, transaction patterns, and use of previously authorized signatures.
TRM's investigation suggests the breach involved Binance's hot wallet signing infrastructure rather than the direct extraction of private keys. Hot wallets are internet-connected cryptocurrency wallets exchanges use to process withdrawals and other transactions.
The distinction is significant. According to TRM, the attacker obtained the ability to make Binance's transaction-signing infrastructure authorize transfers across multiple blockchains. The affected wallets consequently generated valid signatures for transactions controlled by the attacker.
On Ethereum, the operation involved EIP-7702, a feature introduced through the Pectra upgrade on May 7, 2025. The mechanism allows an externally owned account, which normally operates through private-key signatures, to delegate its execution behavior to a smart contract through an authorization.
TRM found that the attacker prepared 50 signed authorizations in advance, each associated with a different transaction count, or nonce. By preparing authorizations for consecutive nonces, the attacker ensured that at least one would remain valid when the malicious transaction was executed.
The attacker then used a malicious sweeper contract to take control of a Binance hot wallet and transfer its assets to an attacker-controlled address.
The initial transaction transferred approximately 167,464 ETH and 63 additional tokens, including US$1.615 billion in USDT. The attacker subsequently continued sweeping funds as new assets entered the compromised wallet.
TRM also identified conventional signed transfers across Binance wallets on other networks, strengthening its assessment that the underlying signing infrastructure had been compromised.
The findings suggest that protecting private keys alone may not be sufficient to secure cryptocurrency exchanges. Transaction authorization systems, employee devices, internal services, and approval mechanisms can also become critical attack surfaces.
The attribution to North Korea also places the incident within a broader pattern of state-linked cryptocurrency theft. According to the BBC, both TRM Labs and Chainalysis identified TraderTraitor as a likely perpetrator, although Binance said it was still working with law enforcement partners to establish the attackers' identities. No group has publicly claimed responsibility.
Binance Freezes US$3 Billion as Markets React
Efforts to contain the stolen assets have involved several cryptocurrency issuers and blockchain networks. Binance reported approximately US$3 billion in frozen assets, while TRM's independent accounting identified approximately US$2.7 billion in on-chain freezes as of 00:30 UTC on October 30.
Tether froze approximately US$1.77 billion in USDT, while Circle blocked approximately US$825 million in USDC. Ripple froze US$40.5 million in RLUSD, and World Liberty Financial froze approximately US$27.8 million in USD1. Arbitrum's Security Council also intervened, moving 8,426 ETH and 74.6 million ARB, worth approximately US$30 million, out of the attacker's control.
These interventions demonstrate the role centralized stablecoin issuers can play in responding to blockchain security incidents. Unlike Bitcoin and Ether, stablecoins such as USDT and USDC have centralized issuers capable of freezing tokens associated with identified malicious addresses.
However, the attacker attempted to move assets beyond those controls before additional freezes could take effect. TRM identified transactions involving decentralized exchange Uniswap and lending protocol Aave, where stolen USDT was exchanged for Ether or used as collateral to borrow additional assets.
Approximately US$325 million in USDT was exchanged for around 122,300 ETH through UniswapX and other intent-based contracts. Another operation involved borrowing approximately 19,760 ETH against US$60 million in USDT through Aave.
TRM estimated that the attacker retained more than 420,000 ETH and 18,270 BTC, representing approximately US$2.4 billion in assets beyond the direct freezing capabilities of centralized token issuers as of its October 30 assessment. The remaining funds are subject to ongoing monitoring and potential recovery efforts.
Meanwhile, Binance has reserved more than US$6.34 billion to cover the incident. According to Teng's October 30 statement reported by CoinDesk, approximately US$5 billion is already held in the affected cryptocurrencies, while the exchange is purchasing the remaining assets through public markets and over-the-counter transactions.
The company has also committed to using its SAFU reserve, established in 2018 to protect customers against security incidents and other emergencies. The fund has historically held approximately US$1 billion in Bitcoin. Binance's initial security update explicitly stated that losses would be covered through both SAFU and company resources.
Binance has suspended withdrawals while rebuilding and testing its infrastructure. Teng said the exchange hopes to restore withdrawal services by Sunday, November 1, while an initial Proof of Reserves update is expected before the release of a more comprehensive investigation report on Monday, November 2.
The incident has also affected cryptocurrency markets. Bitcoin fell below US$77,000, reaching approximately US$76,664 in early trading on October 30. Ether declined approximately 5.7%, while BNB, Binance's associated token, lost approximately 8% in the initial market reaction. Other decentralized finance assets, including AAVE, also experienced substantial declines.
The BBC reported that Binance has more than 300 million registered users worldwide, while the company disclosed in 2024 that it held more than US$160 billion in assets under custody. These figures illustrate the scale of the platform's exposure and the importance of restoring confidence in its operational security.