TRM Research Report: How North Korean Hackers Stole $6.36 Billion from Binance Overnight, and About $2.4 Billion Remains Unfreezable

Author: TRM Team

Compiled by TechFlow

TechFlow Editor's Note:This is the first complete breakdown by on-chain forensics firm TRM Labs of the Binance theft: a high-confidence attribution to North Korea's TraderTraitor, noting that wallets on ten chains simultaneously made 'validly signed' transfers within half an hour, suggesting the issue likely lies in Binance's hot wallet signing system itself, not merely a phishing attack. For investors, the real unresolved question is not the roughly $2.7 billion in stablecoins already frozen, but the fate of about 420,000 ETH and 18,270 BTC held by the attacker—this stash, if moved out through cross-chain bridges, exchange services, and OTC desks, is the potential source of selling pressure on ETH/BTC.

Key Takeaways

On October 29, 2026, an attacker moved approximately $6.36 billion from Binance wallets across ten blockchains, with most of it occurring within about 20 minutes beginning at 20:05 UTC. This makes it the largest cryptocurrency theft on record, about four times the $1.5 billion Bybit theft in February 2025. Binance has confirmed a security incident and paused withdrawals on multiple networks.

Based on reliable on-chain and off-chain intelligence, TRM attributes this attack to North Korea's elite hacking unit TraderTraitor. We have high confidence in this assessment. TRM is tracking the funds and issuing alerts to partners via Beacon Network.

On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper under their control, having prepared 50 presigned authorizations in advance. Within the same time window, wallets on nine other chains also transferred funds to the attacker through ordinary signed transactions. TRM assesses that this indicates a compromise of Binance's hot wallet signing infrastructure.

Tether, Circle, Ripple, and World Liberty Financial froze approximately $2.67 billion in stablecoins, and the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of about $2.7 billion. The attacker raced against the freezes by selling USDT to market makers and borrowing ETH against USDT collateral on Aave. It currently holds more than 420,000 ETH and 18,270 BTC, leaving about $2.4 billion in assets beyond the reach of any issuer.

Incident Timeline

On the evening of October 29, wallets belonging to Binance, the world's largest cryptocurrency exchange, began draining billions of dollars in crypto assets. Within minutes, wallets on XRP Ledger, Ethereum, Bitcoin, Tron, Solana, and four other networks moved balances to addresses controlled by the same attacker. A second wave of transfers around 23:05 UTC affected Binance wallets on Avalanche and Polygon.

Binance said it was investigating a potential security issue and later stated that withdrawals on multiple networks had been temporarily paused as a precautionary measure. Binance said user funds are safe. The incident is still developing, and the data in this article reflects TRM's on-chain observations as of 00:30 UTC on October 30.

Who Was Behind the Attack?

TRM attributes this attack to TraderTraitor, North Korea's premier hacking unit. Our assessment is based on reliable on-chain and off-chain intelligence sources. The FBI previously determined that the $1.5 billion Bybit theft in February 2025 was carried out by this group. Multiple characteristics of this attack align with previous North Korea-linked thefts, including the Bybit case and the April 2026 KelpDAO case: funding operational wallets with small withdrawals from Tornado Cash, beginning setup well before the theft, obtaining signatures in advance, and then executing them all at once. However, the laundering methods observed so far—large-scale exchanges through market makers and lending protocols—differ from the bridge-heavy pattern seen after the Bybit case. As the investigation progresses, TRM will share more findings.

How Much Was Stolen?

TRM tracked every transfer from wallets attributed to Binance to attacker-controlled addresses across ten blockchains. Valued at the prices at the time each asset was drained, the total was approximately USD 6.36 billion. At current prices, the same assets are worth approximately USD 6.23 billion.

Ethereum accounted for approximately USD 3.79 billion, including 200,630 ETH and 185 other tokens, of which 1.875 billion USDT, 823 million USDC, and 88.5 million RLUSD. Bitcoin outflows totaled 18,270 BTC, approximately USD 1.47 billion. Tron outflows totaled 612.7 million USDT and 46.4 million TRX, approximately USD 628 million. XRP Ledger losses totaled 233.46 million XRP, approximately USD 296 million. Solana outflows totaled 970,500 SOL, approximately USD 96 million. Arbitrum, Optimism, and Base together accounted for approximately USD 39 million, including 74.6 million ARB drained on Arbitrum. Avalanche outflows were approximately USD 28 million, and Polygon outflows were approximately USD 10 million.

How the attack unfolded

Preparations began at least 36 hours before the theft. Starting on the morning of October 28, the attacker's operational wallets received three small withdrawals from Tornado Cash, a service used to obscure the source of crypto assets. In the early hours of October 29, the operator deployed the first stage of the attack code and tested it on two wallets. Later that day, the operator rehearsed the final version on a third wallet and then transferred the test funds back to itself. Four hours after this rehearsal ended, the same code was installed on a Binance hot wallet.

The first theft of the night occurred on the XRP Ledger. Between 20:05 and 20:09 UTC, five Binance wallets transferred 233.46 million XRP to the same attacker address, leaving each wallet with only the minimum reserve balance. These XRP have not moved since. Shortly after 20:10 UTC, Binance wallets on Solana and Optimism followed. At 20:20, a Binance Bitcoin hot wallet transferred 18,270 BTC to the attacker address, which began splitting the funds into whole-number 1,000 BTC and 100 BTC shares within the same block. This technique is known as a peel chain and makes funds harder to trace. Less than two minutes later, a Binance hot wallet on Tron transferred 612.7 million USDT and 46.4 million TRX to the attacker.

How the attacker took over Binance hot wallets

A hot wallet is an online wallet that an exchange uses to process customer withdrawals. The Ethereum hot wallet in this case is one of Binance's most widely known wallets.

EIP-7702 was introduced in May 2025 with the Ethereum Pectra upgrade. It allows a standard wallet to delegate its behavior to a smart contract by signing an authorization. Thereafter, every call to the wallet executes the contract's code, and this arrangement remains effective until the wallet signs a new authorization.

At 20:20 UTC, the operator submitted a transaction containing 50 authorizations. Each authorization was signed by the Binance hot wallet, and each pointed it to a sweep contract that accepted only the operator's instructions. Each wallet keeps a running count of transactions it sends, called a nonce, and an authorization is valid only if it matches the wallet's current count at the moment of execution. The Binance hot wallet continuously processed a steady stream of withdrawals, so the count kept advancing. By preparing signatures for 50 consecutive counts in advance, the attacker ensured that at least one would still be valid when the transaction executed. One of them matched, which was all the attacker needed. The signatures were generated in batches in advance.

3 minutes and 24 seconds after the delegation took effect, the operator instructed the Binance hot wallet to transfer its entire balance to an attacker-controlled address. This single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.

The delegation was never revoked. Each time new funds entered this Binance hot wallet, the operator swept them again at UTC 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56. The wallet also served as an executor for another Binance smart account, allowing the attacker to withdraw 823 million USDC from it. Circle then quickly froze this USDC.

Evidence points to Binance's signing infrastructure

Early signs of activity on Ethereum indicated that the attacker may have obtained these authorizations through phishing. However, this explanation only accounts for the Ethereum activity and cannot explain the other chains. During the same time window, five Binance wallets on the XRP Ledger, Binance wallets on Arbitrum, Avalanche, Optimism, and Base, a Binance Bitcoin hot wallet, a Binance Tron hot wallet, and a Binance Solana wallet all transferred funds to the attacker via standard signed transfers. Another Binance hot wallet on Ethereum also moved 28,006 ETH, 55.7 million USDT, and 25.9 million RLUSD in the same manner, without any delegation. Approximately two and a half hours later, at UTC 23:05, Binance wallets on Avalanche and Polygon followed suit.

These wallets belong to different chains and use different key types and signature schemes. All of them generated valid signatures for the attacker within approximately half an hour. TRM assesses that the most likely explanation is that the attacker gained the ability to cause Binance's hot wallet signing system to sign cross-chain transactions according to its intent. The batch of 50 pre-signed authorizations suggests that this access may have been time-limited or that signatures had to be requested through a system. Binance has not yet disclosed the root cause.

Stablecoin Freezes and Asset Conversions

Stablecoin issuers acted quickly, and freeze operations expanded throughout the night. At UTC 23:35, Binance stated that the verified total frozen amount had reached USD 2.54 billion. Including subsequent freezes, as of UTC 00:30, TRM counted approximately USD 2.7 billion frozen on-chain:

Tether, approximately 1.77 billion USDT. At UTC 21:01, 37 minutes after the main sweep, Tether froze 971.1 million USDT in the main receiving wallet. Subsequent swept funds landed in this already-frozen wallet, which currently holds 1.175 billion USDT. Tether also froze 205 million USDT in two other attacker wallets on Ethereum, 378.7 million USDT in two attacker wallets on Tron, and 8.4 million USDt on Avalanche. An additional 6.2 million USDT0 on Polygon has also been frozen.

Circle, approximately 825 million USDC. At UTC 21:04, Circle coordinated with law enforcement to freeze 823 million USDC in the main receiving wallet. It subsequently froze 1.56 million USDC that the attacker had obtained by swapping AVAX and bridged from Avalanche to Ethereum.

Ripple, 40.5 million RLUSD. At UTC 22:01, Ripple froze the wallet holding the stolen RLUSD, when 40.5 million of the 88.5 million RLUSD still remained in it. It also froze the RLUSD in the compromised Binance hot wallet, preventing newly deposited funds from being swept. Binance co-CEO Yi He stated that Ripple helped block the transfer of approximately USD 200 million; TRM has confirmed the freeze of 40.5 million RLUSD on-chain.

World Liberty Financial, 27.8 million USD1. World Liberty Financial froze 27.8 million USD1 in the main receiving wallet at 22:10 UTC and froze the USD1 in the compromised Binance hot wallet at 22:26 UTC.

Arbitrum Security Council, 8,426 ETH and 74.6 million ARB. The Arbitrum Security Council is a small group that can take emergency action on the Arbitrum network. At 00:08 UTC, it exercised these powers and forced two transfers from the attacker's wallets on Arbitrum, moving 8,426 ETH and 74.6 million ARB (about USD 30 million) out of the attacker's control.

In the first few hours, the attacker, at great cost, converted stablecoins that could be frozen into assets beyond the reach of any issuer. Approximately 325 million USDT were sold to professional fillers and market makers through UniswapX and other intent-based contracts in exchange for about 122,300 ETH. This implied a price near USD 2,650 per ETH, while the market price of ETH at the time was between USD 2,300 and USD 2,350, a discount of more than 10%. The remaining 175 million USDT in this batch were frozen.

The attacker's second wallet deposited 60 million USDT into lending protocol Aave and borrowed about 19,760 ETH against it as collateral; Aave subsequently froze the affected markets. On Tron, 300 million USDT were transferred into a wallet that began depositing these USDT into lending protocol JustLend. Another 200 million USDT were swapped on Uniswap through a series of hop wallets, and 30 million USDT along that chain were frozen. 88.5 million RLUSD were transferred into a wallet after two hops; that wallet sold 48 million of them through decentralized exchanges between 21:42 and 22:01 UTC until Ripple froze the remaining 40.5 million.

As ETH was consolidated into a small number of wallets and 18,270 BTC flowed along the peeling chain, the attacker controlled approximately USD 2.4 billion in assets beyond the reach of any issuer. Based on experience from previous large-scale thefts, TRM expects the next phase to involve cross-chain bridges, swap services, and over-the-counter (OTC) brokers. TRM is monitoring the output addresses of the peeling chain and consolidation wallets to detect these movements.

What should exchanges and compliance teams do now?

Exchanges and compliance teams should screen deposits and counterparties against the attacker addresses already flagged by TRM. Funds from the Bitcoin peeling chain and ETH consolidation wallets are likely to flow into exchanges, swap services, and OTC desks over the coming days.

Treasury management teams should monitor Ethereum-compatible wallets for EIP-7702 delegations, which appear as code at an address that should not have code. Any such delegation in a treasury wallet should immediately trigger an alert. Teams should prepare a set of tested, pre-approved revocation signing procedures.

Signing policies should reject unexpected EIP-7702 authorizations. Requesting numerous authorizations for a range of transaction nonces should be treated as an indicator of compromise. Signing infrastructure and approval paths should be isolated by chain and wallet tier. In this incident, a single actor obtained valid signatures for wallets across ten chains within a few hours.

Market makers and solvers should screen counterparties before filling large orders. Approximately 325 million USDT were sold to market makers and solvers by a wallet that had received these USDT from the hacker only minutes earlier. Real-time address screening would have flagged it.

FAQ

What happened at Binance?

On October 29, 2026, an attacker moved approximately $6.36 billion from Binance wallets across ten blockchains, involving Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon. Binance confirmed a security incident and suspended withdrawals across multiple networks.

Who is the mastermind behind the Binance hack?

Based on reliable on-chain and off-chain intelligence, TRM attributed the Binance hack to TraderTraitor, a North Korean state-sponsored hacker group. The $1.5 billion Bybit hack in February 2025 was also carried out by this group.

What is EIP-7702, and how was it exploited?

EIP-7702 allows a regular Ethereum wallet to execute code from a smart contract by signing an authorization. The attacker used a pre-signed authorization to make the Binance hot wallet run a sweeper contract that only the attacker could call, then drained the wallet and continued sweeping new funds deposited afterward.

How much of the stolen crypto assets has been frozen?

Tether, Circle, Ripple, and World Liberty Financial have frozen approximately $2.67 billion in stablecoins, and the Arbitrum Security Council froze approximately $30 million in ETH and ARB, bringing the total to approximately $2.7 billion. The attacker still controls more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion, along with a small amount of assets on other chains.

How does this compare with other major hacks?

At approximately $6.36 billion, this is the largest cryptocurrency theft on record, about four times the $1.5 billion Bybit hack in February 2025. Even after deducting the frozen stablecoins, the amount currently held by the attacker still exceeds that of any previous theft.

Source: TechFlow