- An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains on Oct 29, 2026.
- Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, while Arbitrum froze additional assets.
- TRM Labs and Chainalysis attributed the activity to TraderTraitor, a North Korean cybercrime group.
Binance wallets lost approximately $6.36 billion on Oct 29, 2026, after an attacker moved funds across ten blockchains. Binance suspended deposits and withdrawals while it conducted security checks, froze funds and worked with law enforcement, it said.
The transfers affected Binance hot wallets and included unauthorized withdrawals totaling about $6.4 billion, according to Chainalysis. TRM Labs said the attacker still controlled more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion.
Binance said the attack traced initially to a compromised engineer’s laptop that gave access to systems enabling unauthorized withdrawal transactions. It later said its investigation found additional breach points, while Binance.US said its platform for American residents was not affected.
On this page
An EIP-7702 delegation turned a Binance hot wallet into a sweeper
Chainalysis said the attacker swapped $325 million in stablecoins for $285 million in ETH over nearly 20 minutes to stay ahead of freezes. It said the laundering showed signs of automation, with thousands of transactions and many addresses first receiving exactly 1 TRX.
Platforms froze about $2.7 billion in assets
TRM Labs said Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins. Arbitrum’s Security Council also froze 8,426 ETH and 74.6 million ARB on its network, bringing the total to roughly $2.7 billion.
Chainalysis said its customers can identify exposure to addresses linked to the incident through KYT and Address Screening. Chainalysis also said funds from the Binance incident commingled on-chain with funds from last month’s Bitget theft, which it attributed to North Korea.
Binance found additional breach points after its initial review
Binance said its initial checks pointed to a compromised engineer’s laptop, but its subsequent investigation uncovered additional points of breach. The company said it had not found evidence of a wallet private-key leak.
Binance said it was working with law enforcement, while the FBI said it was engaged with public and private partners to understand the scope of the activity, evaluate potential impacts and coordinate investigative steps.
Binance said it would cover all hacking losses and that user funds were safe. It also said its investigation had found no evidence of a wallet private-key leak and had not attributed responsibility to an individual.
The FBI was aware of the incident and was coordinating investigative steps with public and private partners, according to a statement reported by CNET. TRM Labs and Chainalysis attributed the activity to TraderTraitor, but Binance and law enforcement had not confirmed that attribution.
What to do now
- Exchanges and compliance teams should screen deposits and counterparties against the attacker addresses TRM Labs has labeled.
- Treasury teams should monitor Ethereum-compatible wallets for unexpected EIP-7702 delegations and treat any such delegation on a treasury wallet as an immediate alert.
FAQ
What happened to Binance wallets?
An attacker moved approximately $6.36 billion from Binance wallets on ten blockchains on Oct 29, 2026. Binance suspended deposits and withdrawals while it conducted security checks and froze funds.
How much of the Binance funds were frozen?
TRM Labs said about $2.67 billion in stablecoins were frozen by Tether, Circle, Ripple and World Liberty Financial. Arbitrum also froze assets, bringing the reported total to roughly $2.7 billion.
Was Binance.US affected by the incident?
Binance.US said its platform, which provides trading services specifically for American residents, was not affected. The incident concerned Binance.com.
How did the attacker move the Binance funds?
TRM Labs said the attacker used an EIP-7702 delegation and 50 pre-signed authorizations to turn a Binance hot wallet into a controlled sweeper. Chainalysis said the attacker also swapped stablecoins for ETH while platforms worked to freeze funds.
Sources
- Tracking AI adoption in North Korean threat actor tradecraft | Microsoft Security Blog, MicrosoftPrimary
- North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History | TRM Labs, TRM LabsPrimary
- Binance Hack: Tracing the $6.4 Billion Theft to North Korea - Chainalysis, ChainalysisPrimary
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds, The Record
- Crypto giant Binance hit by $6.3bn hack suspected to be largest in history, BBC
- ‘Largest Crypto Hack in History’: Binance Loses More Than $6B, CNET
- Coinbase Tumbles 11% as Record Binance Hack Hits Crypto and Trading Revenue Slides; Strategy Sinks 12%, Robinhood Plunges 10%, Circle Drops 9%, 247wallst.com
How we checked this story
| Claim | Source | Status |
|---|---|---|
| Binance said hackers stole $6.3 billion worth of funds in a Thursday evening attack that likely amounts to the largest crypto theft in history. | Binance, via The Record | Attributed |
| TRM Labs said an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains on October 29, 2026. | TRM Labs | Confirmed |
| Chainalysis said unauthorized transfers totaled approximately $6.4 billion after funds began leaving Binance hot wallets around 4:20 p.m. Eastern Time on October 29. | Chainalysis | Confirmed |
| Binance said an engineer’s compromised laptop allowed an attacker to access systems that enabled unauthorized withdrawal transactions. | Binance, via The Record | Attributed |
| Binance later said its investigation uncovered additional breach points beyond the compromised engineer’s laptop. | Binance, via BBC | Attributed |
| TRM said the attacker used an EIP-7702 delegation and 50 pre-signed authorizations to turn a Binance hot wallet into a controlled sweeper. | TRM Labs | Confirmed |
| TRM attributed the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on- and off-chain intelligence. | TRM Labs | Confirmed |
| Chainalysis attributed the hack to TraderTraitor and said stolen Binance funds commingled on-chain with funds from last month’s Bitget theft. | Chainalysis | Confirmed |
| TRM said Tether, Circle, Ripple, and World Liberty Financial froze about $2.67 billion in stablecoins, while Arbitrum froze additional assets. | TRM Labs | Confirmed |
| Chainalysis said the attacker swapped $325 million in stablecoins for $285 million in ETH over nearly 20 minutes to stay ahead of freezes. | Chainalysis | Confirmed |
| Chainalysis said laundering showed signs of automation, including thousands of transactions and addresses that first received exactly one TRX. | Chainalysis | Confirmed |
| Binance suspended deposits and withdrawals while conducting security checks, freezing funds, and working with law enforcement. | Binance, via The Record | Attributed |
| Binance said it would cover all hacking losses and said user funds were safe. | Binance, via The Record | Attributed |
| Binance said it had found no evidence of a wallet private-key leak and had not attributed responsibility to an individual. | Binance, via BBC | Attributed |
| Binance.US said its platform, which provides trading services specifically for American residents, was not affected. | Binance.US, via BBC | Attributed |
| Chainalysis said its customers can identify exposure to incident-linked addresses using KYT and Address Screening. | Chainalysis | Confirmed |
| Microsoft said North Korean threat actors commonly target cryptocurrency and financial organizations, technology companies, software supply chains, governments, and education organizations. | Microsoft Threat Intelligence, via Microsoft | Confirmed |
| Microsoft said North Korean threat actors’ AI-enabled operations remain human-directed and have not become fully autonomous. | Microsoft Threat Intelligence, via Microsoft | Confirmed |
| CNET reported that Binance was working with the FBI and U.S. Secret Service on the investigation. | CNET | Attributed |
| CNET reported that Binance committed to covering $6.34 billion in traders’ losses, with $5 billion held in exact token assets. | Binance, via CNET | Attributed |
| CNET reported that Binance planned to purchase the remaining token assets through other market channels. | Binance, via CNET | Attributed |
| CNET reported that the FBI was aware of the incident and was coordinating investigative steps with public and private partners. | FBI, via CNET | Attributed |
| CNET reported that TRM and Chainalysis attributed the hack to TraderTraitor, while Binance and law enforcement had not confirmed that attribution. | CNET | Attributed |
| Microsoft published its report on Oct 29, 2026. | Microsoft | Confirmed |
| trmlabs.com published its report on Oct 30, 2026. | trmlabs.com | Confirmed |
| chainalysis.com published its report on Oct 30, 2026. | chainalysis.com | Confirmed |
Could not verify
- Whether Binance’s additional breach points have been identified is not established.
- Whether the attackers’ North Korea attribution has been confirmed by Binance or law enforcement is not established.
- Whether the compromised laptop was the only initial access path is not established.
- How many Binance users or accounts were affected is not established.
Related stories
Data LeaksGMO Internet Group reward program follows Onamae.com Desktop Cloud breach
Vulns & PatchesCisco Catalyst SD-WAN flaw exploited to deploy KeyDrift malware
Vulns & PatchesFBI seized Virtualine domain in international operation