Binance Hack Takes $6.3 Billion Across Ten Blockchains as Analysts Point to North Korea

Binance, the world’s largest crypto exchange, lost about $6.3 billion in a hack on Thursday evening, the largest crypto theft on record and roughly four times the $1.5 billion stolen from Bybit in February 2025. Blockchain analytics firms TRM Labs and Chainalysis attribute the Binance hack to TraderTraitor, a North Korean state-backed hacking unit. The exchange has paused withdrawals and says it will cover every loss.

Twenty minutes across ten networks

The first transfers left five Binance wallets on the XRP Ledger at about 20:05 UTC on 29 October. Wallets on Solana, Optimism, Arbitrum, Base, Bitcoin, Tron and Ethereum followed within minutes, and a second wave reached Binance wallets on Avalanche and Polygon at around 23:05 UTC, bringing the total to ten blockchain networks. Most of the roughly $6.36 billion was gone within 20 minutes. The haul included 18,270 bitcoin, more than 200,000 ether and billions of dollars in stablecoins, the dollar-pegged tokens such as USDT and USDC.

The attack was staged a day in advance, according to TRM’s analysis. The attacker funded an operator wallet with three small withdrawals from Tornado Cash, a crypto mixing service, on the morning of 28 October, then tested the attack code on three wallets before installing it on a Binance hot wallet, the internet-connected wallet an exchange uses to process withdrawals. The attacker’s route into Ethereum used a feature added to the network in May 2025, Ethereum Improvement Proposal 7702 (EIP-7702), which lets a wallet hand control of its behaviour to a smart contract through a signed authorisation, and the attacker held 50 of them pre-signed by Binance’s Ethereum hot wallet.

TRM said the Tornado Cash funding, the staging well before the theft and the burst of signatures obtained in advance match earlier North Korea-linked heists, including Bybit and the Kelp DAO exploit in April. TRM and Chainalysis both named TraderTraitor, the group the FBI previously tied to the Bybit theft.

What Binance says happened

Binance said its initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container and let them submit unauthorised withdrawals. The exchange found no evidence that wallet private keys had leaked. Binance said in its investigation update on Friday morning that investigators had since uncovered additional points of breach, that the outflows stopped once it paused withdrawals, and that it was working with law enforcement.

Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected. The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far. We will continue to provide further updates through official Binance channels as more verified information becomes available.

— Binance (@binance) October 30, 2026

Withdrawals are on track to resume in about 45 hours from that update, which points to early Sunday, and Binance says deposits are operating normally. The exchange has not yet said what the additional points of breach are.

Frozen funds and a pledge to pay

Stablecoin issuers moved within the first hour. Tether froze 971.1 million USDT at 21:01 UTC and Circle froze 823 million USDC three minutes later, with Ripple and World Liberty Financial freezing smaller amounts of their own tokens. Binance puts the total frozen with its partners at around $3 billion, and Arbitrum’s Security Council forced 8,426 ether and 74.6 million ARB tokens out of the attacker’s wallet on its network, as it did after the Kelp DAO theft. The attacker still holds more than 420,000 ether and the 18,270 bitcoin, worth about $2.4 billion, according to TRM.

Binance said it will cover all losses from its Secure Asset Fund for Users (SAFU), an emergency reserve created in 2018, and from company funds, and that user funds are safe. The pledge covers 320 million users registered outside the United States. Binance later said it had set aside more than $6.34 billion, including $5 billion already held in the affected tokens.

Bitcoin fell more than 3% in 24 hours to around $77,300, and CoinGlass data showed over $1.6 billion in leveraged crypto positions liquidated over the same period. Binance has promised a detailed technical post-mortem once its investigation is complete and the facts are fully verified. That document is where the wider fintech industry will learn how an intrusion that Binance first traced to a single engineer’s laptop ended up moving funds out of wallets on ten networks.

Binance lost about $41 million in bitcoin from a hot wallet in May 2019 and reopened withdrawals a week later. This theft is more than 150 times larger, Binance is aiming to reopen in under three days, and the money to cover users is already set aside, which leaves the post-mortem as the one thing customers are still waiting for.

Editor’s note
Every piece goes through careful verification, but mistakes can happen. Readers who spot an error or have additional information can write to rosalia@thebrightminded.com.