On October 29, 2026, Binance was hit by the largest cyber heist in digital asset history, with attackers draining approximately $6.36 billion across ten separate blockchains. Leading blockchain analytics firms—including TRM Labs and Chainalysis—attributed the breach with “high confidence” to TraderTraitor, an elite state-sponsored cyber unit linked to North Korea’s Reconnaissance General Bureau.
The Anatomy of the Attack
The breach unfolded rapidly, beginning around 20:05 UTC on October 29. According to on-chain tracking data:
- Speed and Scope: The attacker moved the vast majority of the $6.36 billion in roughly 20 minutes across 10 networks, including Ethereum, XRP Ledger, Solana, and Optimism.
- Execution Strategy: On Ethereum, which accounted for approximately $3.79 billion of the drained assets, the attacker leveraged an EIP-7702 delegation with roughly 50 pre-signed authorizations prepared in advance. This effectively converted a Binance hot wallet into an automated sweeper contract controlled solely by the attacker, siphoning new incoming funds automatically. On other networks, funds were drained via standard signed multi-chain transfers.
- Attack Vector: Preliminary internal reviews suggested an engineer’s compromised laptop may have served as the initial intrusion vector, granting unauthorized access into internal service containers. However, Binance CEO Richard Teng emphasized that the breach was not a simple single-credential exploit or “one-click” action, pointing instead to a complex attack sequence that compromised hot wallet signing workflows. Binance confirmed there is no evidence that private keys themselves were leaked.
The North Korea Attribution
TRM Labs and Chainalysis stated that the operational footprint, infrastructure reuse, and on-chain money-laundering behavior closely matched previous operations conducted by TraderTraitor (also linked to the Lazarus Group ecosystem).
The intrusion methods mirror the February 2025 cyberattack against cryptocurrency exchange Bybit, which resulted in a $1.5 billion theft and was formally attributed to Pyongyang by the U.S. Federal Bureau of Investigation (FBI). For heavily sanctioned North Korea, state-backed cryptocurrency theft has long served as an illicit foreign currency pipeline to finance weapons development and government operations.
Asset Freezes and On-Chain Countermeasures
Unlike earlier decentralized finance exploits where funds vanished instantly through mixers, the scale of centralized stablecoins involved prompted emergency industry coordination:
- Issuer Freezes: Tether, Circle, Ripple, and World Liberty Financial froze roughly $2.67 billion to $3 billion in centralized stablecoins (including USDT, USDC, and RLUSD) before they could be fully laundered.
- Decentralized Network Responses: Arbitrum’s Security Council intervened on its network to freeze an additional 8,426 ETH and 74.6 million ARB.
- Attacker Conversion Race: Anticipating freezes, the attacker rapidly converted substantial balances by swapping USDT via OTC market makers and taking out ETH collateral loans on decentralized lending protocols like Aave.
- Unfrozen Balance: The perpetrator retained custody of more than 420,000 ETH and 18,270 BTC (representing approximately $2.4 billion), assets on non-freezable, censorship-resistant base layers.
Binance Response and User Impact
Following the detection of abnormal outflows, Binance took the following immediate steps:
- Service Halted: Temporarily suspended withdrawals across affected networks to overhaul the withdrawal pipeline and revoke all compromised authorizations. Deposits remained operational.
- SAFU Coverage: Both current CEO Richard Teng and co-founder Changpeng Zhao confirmed that user balances are fully backed, stating that any unrecovered shortfall will be covered entirely by Binance’s Secure Asset Fund for Users (SAFU) and corporate reserves.
- Law Enforcement Coordination: The exchange engaged blockchain intelligence firms and international law enforcement agencies to map the downstream flow of stolen Bitcoin and Ether. Binance announced it will publish a full technical post-mortem alongside an updated Proof of Reserves once remediation concludes.
About The Author
