Massive Cyber Heist: North Korean Hackers Drain $6.36 Billion from Binance Wallets
In an unprecedented act of cyber theft, North Korea’s infamous TraderTraitor group managed to siphon approximately $6.36 billion from Binance wallets across ten different blockchains on October 29, 2026. This staggering figure, noted by TRM Labs, has been classified as the largest cryptocurrency theft on record, dwarfing previous incidents, notably the $1.5 billion Bybit heist that occurred in February 2025.
Breakdown of the Attack
According to a comprehensive technical report released by TRM Labs, the heist was meticulously orchestrated, with funds being extracted in a swift operation that spanned roughly 20 minutes, commencing at 20:05 UTC. During this interval, Binance wallets across multiple networks—including the XRP Ledger, Ethereum, Bitcoin, Tron, Solana, and others—began transferring their balances to a singular account controlled by the attackers.
The operation experienced a second wave of activity around 23:05 UTC, specifically targeting Avalanche and Polygon. In response, Binance proactively suspended withdrawals across several networks, asserting that user funds remained secure despite the extensive breaches.
Preparation and Precision
The orchestrators of this theft had evidently laid the groundwork well in advance, with preparatory actions taking place at least 36 hours before the heist. On October 28, they utilized an operator wallet to make small withdrawals through Tornado Cash, a service associated with obfuscating transaction origins. Following subsequent tests on two separate wallets, the attackers rehearsed their plan on a third, ultimately installing their malicious code on one of Binance’s hot wallets just four hours later.
The assault’s execution was marked by technical precision. As part of the operation, one transaction was submitted to Ethereum at 20:20 UTC containing 50 EIP-7702 authorizations, all signed by the compromised Binance hot wallet. This clever maneuver pointed to a swiping contract that could only accept instructions from the malicious operator. The strategic planning ensured that even as the wallet’s nonce advanced with ongoing withdrawals, at least one signature remained valid, facilitating the successful transfer of large sums.
In the span of three minutes and 24 seconds, the attacker successfully moved 167,464 ETH and numerous tokens, including approximately 1.615 billion USDT. The delegation remained operational, allowing the hacker to continue extracting new deposits in the following hours.
Varied Tactics and Tools
Interestingly, the technique employed across the other nine chains relied on conventional signed transfers, eschewing delegation methods, which typically require different key types and signing mechanisms. They still yielded valid signatures within an approximate half-hour timeframe, reinforcing the sophistication of the attack.
TRM Labs’ analysis indicated that the attacker manipulated Binance’s signing system, making it sign transactions as per their preference. Preliminary investigations by Binance suggest that the breach may have stemmed from a compromised engineer’s laptop; however, specifics regarding the root cause remain undisclosed.
In terms of attribution, analysts have noted that certain patterns in this incident echo previous attacks, including elements like Tornado Cash funding, staged preparation, and pre-obtained signatures executed in a single surge. These traits were prominently observed in both the Bybit and KelpDAO breaches.
Immediate Repercussions
As the fallout from the theft unfolded, TRM reported approximately $2.7 billion had been frozen within hours of the heist. Tether successfully froze around 1.77 billion USDT, Circle locked down about 825 million USDC, while Ripple and World Liberty Financial froze 40.5 million RLUSD and 27.8 million USD1, respectively. In a decisive move, Arbitrum’s Security Council also stepped in, relocating 8,426 ETH and 74.6 million ARB—valued at roughly $30 million—out of the attackers’ reach.
In a frantic response to avoid detection and halt further losses, the attacker liquidated about 325 million USDT to market makers for an estimated 122,300 ETH at a discount exceeding 10%. Furthermore, they borrowed approximately 19,760 ETH against USDT through Aave. After these transactions, the hackers retained control over more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion. Engaging in further obfuscation, the BTC is reportedly being moved through a peel chain.
Conclusion and Best Practices
As the investigation progresses, TRM anticipates that bridges, swap services, and over-the-counter brokers may soon be targeted. Organizations involved in cryptocurrency operations are urged to implement rigorous screening measures for deposits and counterparties, particularly against labeled attacker addresses. Additionally, security protocols should include robust mechanisms to reject unexpected EIP-7702 authorizations, treat multiple authorizations across a spectrum of nonces as indicators of compromise, and maintain a well-established revocation strategy.
Market makers and similar entities are advised to vet their counterparties prior to fulfilling significant orders. As this remarkable incident unfolds, the implications for security within the cryptocurrency ecosystem are both profound and urgent, highlighting an ongoing need for vigilance and adaptability in the face of increasingly sophisticated cyber threats.