Binance, the world’s largest cryptocurrency exchange by trading volume, has confirmed that an attacker drained an estimated $6.3 billion in digital assets from its hot wallets on October 29, 2026, in what blockchain analytics firms describe as the largest cryptocurrency theft on record. The exchange suspended withdrawals, revoked the compromised authorization and said it will cover every dollar of losses from its emergency fund and company reserves.
Blockchain intelligence firms TRM Labs and Chainalysis have both attributed the attack with high confidence to TraderTraitor, a North Korean state-backed hacking group. Binance has not publicly attributed the attack, and no law enforcement agency had issued a public attribution at time of publication.
A Compromised Engineer Laptop Opened the Door
In a security incident update, Binance said its initial investigation points to a compromised laptop belonging to a DevOps engineer. The attacker used that foothold to reach a service container and submit unauthorized withdrawal transactions from the exchange’s hot wallets.
Binance said it found no evidence that any wallet private key had leaked. Co-CEO Richard Teng later stressed that the intrusion went beyond a single stolen login: “the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.”
The exchange has since said it uncovered additional points of breach during its review, and that it remains on track to reopen withdrawals within roughly 45 hours. Deposits and trading continued to operate normally. Binance.US said its platform was not affected.
20 Minutes, 10 Blockchains, $6.36 Billion
According to TRM Labs, roughly $6.36 billion left Binance across 10 blockchains, with most of it moving in a burst of about 20 minutes beginning at 4:05 PM ET on October 29. That is about 4 times the $1.5 billion stolen from Bybit in February 2025, an attack the FBI attributed to the same North Korean group.
The firm’s breakdown of the stolen assets includes:
- Ethereum: about $3.79 billion, including 200,630 ETH, 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD
- Bitcoin: 18,270 BTC, worth about $1.47 billion
- Tron: about $628 million
- XRP Ledger: 233.46 million XRP, worth about $296 million
- Solana: 970,500 SOL, worth about $96 million
- Other networks: about $77 million across Arbitrum, Optimism, Base, Avalanche and Polygon
On Ethereum, researchers said the attacker used an EIP-7702 delegation backed by 50 pre-signed authorizations to turn a Binance hot wallet into an attacker-controlled sweeper contract. On the other 9 chains, the funds left through ordinary signed transfers, which TRM Labs said points to a compromise of Binance’s hot-wallet signing infrastructure rather than a flaw in any single blockchain.
Stablecoin Issuers Froze Nearly Half the Haul
The fact that so much of the loot sat in centrally issued stablecoins gave defenders an unusual opening. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins tied to the attacker, and the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB. Binance put the total frozen on-chain at about $3 billion, while Chainalysis, in its latest findings, counted about $2.8 billion.
The attacker moved quickly to shrink that exposure. Chainalysis said the attacker swapped about $325 million in stablecoins into $285 million worth of ETH before the first freezes landed at about 5:14 PM ET. TRM Labs said the attacker also sold USDT to market makers and borrowed ETH on the Aave lending protocol, and now controls more than 420,000 ETH plus the 18,270 BTC, worth about $2.4 billion, beyond the reach of any issuer freeze.
Why Analysts Point to TraderTraitor
TRM Labs said the operation follows the same playbook seen in the Bybit theft and the April 2026 KelpDAO attack: attacker wallets funded through Tornado Cash, infrastructure staged in advance, and pre-signed transactions fired off in a single burst. Chainalysis added that the stolen funds have already been commingled with proceeds from last month’s Bitget exploit, which has also been attributed to North Korea, and that the laundering follows an automated pattern it has tracked across prior North Korean thefts.
North Korean operators have a long history of targeting crypto firms through their staff rather than their code. BreachNews has previously covered how North Korean hackers drained $285 million from Drift Protocol after a six-month infiltration and how a separate campaign used AI-powered social engineering to drain funds from Zerion. A compromised engineer workstation fits that pattern closely.
What Binance Users Should Know
Binance said user funds are safe and that all losses will be covered by its Secure Asset Fund for Users (SAFU) and company funds. The exchange said it is working with law enforcement and blockchain partners, will publish an updated Proof of Reserves once remediation is complete, and has promised a full post-mortem.
- Expect withdrawals to stay paused until Binance confirms they have resumed through its official announcement page.
- Ignore messages offering “early withdrawal,” refunds or compensation claims. Scammers routinely exploit major incidents like this one.
- Confirm any support contact through the official Binance app or website, never through links sent by direct message.
BreachNews will update this story as Binance releases its post-mortem and as law enforcement agencies comment on attribution.
