North Korea’s TraderTraitor group drained about $6.36 billion from Binance wallets across ten blockchains on October 29, 2026. TRM Labs, which published the findings, calls it the largest crypto theft on record.
TRM Labs says the total is about four times the $1.5 billion Bybit heist of February 2025.
North Korean hackers Binance theft
According to technical research published by TRM Labs, most of the funds left in about 20 minutes, starting at 20:05 UTC. Binance wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and other networks sent their balances to a single attacker.
A second wave around 23:05 UTC hit Avalanche and Polygon. Binance suspended withdrawals on several networks and says user funds are safe.
Preparation began at least 36 hours earlier. An operator wallet received small Tornado Cash withdrawals on October 28. The attacker then tested its code on two wallets and rehearsed on a third.
About four hours after the rehearsal, the same code was installed on a Binance hot wallet.
On Ethereum, the attacker submitted one transaction at 20:20 UTC containing 50 EIP-7702 authorizations. Each was signed by the Binance hot wallet and pointed it to a sweeper contract that accepted instructions only from the operator.
Because the wallet’s nonce kept advancing with withdrawals, the 50 consecutive nonces guaranteed that one signature would still be valid.
Three minutes and 24 seconds later, the operator moved 167,464 ETH and 63 tokens, including 1.615 billion USDT. The delegation stayed active, so the attacker swept new deposits again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.
The other nine chains used ordinary signed transfers, not delegation. These wallets use different key types and signing schemes, yet all produced valid signatures within about 30 minutes.
TRM’s assessment is that the attacker could make Binance’s hot wallet signing system sign transactions of its choosing. BBC reports that Binance’s preliminary finding points to a compromised engineer’s laptop. Binance has not published a root cause.
Attribution rests on patterns seen in earlier heists. These include Tornado Cash funding, early staging and pre-obtained signatures executed in one burst. These match the Bybit and KelpDAO attacks.
For background, see the earlier coverage of TraderTraitor targeting cloud platforms and the ZachXBT investigation into laundering of Lazarus proceeds.
TRM counts about $2.7 billion frozen as of 00:30 UTC on October 30, with Tether freezing about 1.77 billion USDT, Circle freezing about 825 million USDC, Ripple freezing 40.5 million RLUSD, and World Liberty Financial freezing 27.8 million USD1.
In addition, Arbitrum’s Security Council moved 8,426 ETH and 74.6 million ARB, about $30 million, out of the attacker’s reach.
The attacker raced the freezes. It sold about 325 million USDT to market makers for roughly 122,300 ETH, at a discount of more than 10%. It also borrowed about 19,760 ETH against USDT on Aave.
The attacker still controls over 420,000 ETH and 18,270 BTC, about $2.4 billion. The BTC is moving through a peel chain. TRM expects bridges, swap services and OTC brokers to come next.
Organizations should screen deposits and counterparties against labeled attacker addresses, alert on any EIP-7702 delegation on treasury wallets, and keep a pre-approved revocation method ready.
Security teams must reject unexpected EIP-7702 authorizations, treating requests for many authorizations across a range of nonces as a compromise indicator.
Furthermore, teams should separate signing infrastructure and approval paths by chain and wallet tier, while market makers and solvers must screen counterparties before filling large orders. The investigation is ongoing, and figures may change.
