TRM Report: How North Korean Hackers Stole $6.36 Billion from Binance Overnight—and Why Another Roughly $2.4 Billion May Be Impossible to Freeze

Author: TRM Team
Compiled by: Deep Tide TechFlow
Deep Tide Briefing: This is the first comprehensive breakdown of the Binance hack by on-chain forensics firm TRM Labs. It attributes the attack with high confidence to North Korea-linked TraderTraitor and notes that assets were transferred out across ten chains with “valid signatures” within half an hour. This suggests the issue likely lay in Binance’s hot wallet signing system itself, rather than being merely a phishing attack. For investors, the real uncertainty is not the roughly $2.7 billion in stablecoins already frozen, but what will happen to the approximately 420,000 ETH and 18,270 BTC in the attackers’ hands. The potential selling pressure on ETH and BTC will come from these assets being moved through cross-chain bridges, exchange services, and OTC desks.
At a glance
On October 29, 2026, an attacker moved approximately $6.36 billion from Binance wallets across ten blockchains, mostly within about 20 minutes starting at 20:05 UTC. This makes it the largest cryptocurrency theft on record, about four times the $1.5 billion Bybit theft in February 2025. Binance confirmed a security incident and suspended withdrawals on multiple networks.
Based on reliable on-chain and off-chain intelligence, TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit. We have high confidence in this assessment. TRM is tracking the funds and alerting partners through the Beacon Network.
On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into an attacker-controlled “sweeper,” with 50 pre-signed authorizations prepared in advance. Within the same time window, Binance wallets on the other nine chains transferred funds to the attacker through ordinary signed transfers. TRM assesses that this points to a compromise of Binance’s hot-wallet signing infrastructure.
Tether, Circle, Ripple, and World Liberty Financial froze approximately $2.67 billion in stablecoins, while the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB on its network, bringing the total to approximately $2.7 billion. The attacker raced against the freezes, selling USDT to market makers and borrowing ETH on Aave using USDT as collateral. The attacker now holds more than 420,000 ETH and 18,270 BTC—approximately $2.4 billion in assets beyond the reach of any issuer.
How the incident unfolded
On the evening of October 29, wallets belonging to Binance, the world’s largest cryptocurrency exchange, began sending out billions of dollars in crypto assets. Within minutes, Binance wallets on XRP Ledger, Ethereum, Bitcoin, Tron, Solana, and four other networks transferred their balances to addresses controlled by the same attacker. A second wave of transfers around 23:05 UTC affected Binance wallets on Avalanche and Polygon.
Binance said it was investigating a potential security issue, then announced that it had temporarily suspended withdrawals on multiple networks as a precaution. Binance said user funds were safe. The incident is still developing, and the figures in this article reflect what TRM observed on-chain as of 00:30 UTC on October 30.
Who was behind it
TRM attributes the attack to TraderTraitor, North Korea’s premier hacking unit. Our assessment is based on reliable on-chain and off-chain intelligence sources. The FBI attributed the $1.5 billion Bybit theft in February 2025 to the same group. Several features of this attack align with previous North Korea-linked thefts, including the Bybit incident and the KelpDAO incident in April 2026: funding operational wallets with small withdrawals from Tornado Cash, preparing well in advance of the theft, and obtaining signatures ahead of time before executing them all at once. However, the laundering methods observed so far—large swaps through market makers and lending protocols—differ from the bridge-heavy pattern seen after the Bybit incident. TRM will share further findings as the investigation progresses.
How much was stolen
TRM tracked every transfer from Binance-owned wallets to attacker-controlled addresses across ten blockchains. Valued at the time each asset was moved, the total was approximately $6.36 billion. At current prices, those same assets are worth approximately $6.23 billion.
Ethereum accounted for approximately $3.79 billion, including 200,630 ETH and 185 other tokens, among them 1.875 billion USDT, 823 million USDC, and 88.5 million RLUSD. Bitcoin outflows totaled 18,270 BTC, worth approximately $1.47 billion. Tron outflows totaled 612.7 million USDT and 46.4 million TRX, worth approximately $628 million. XRP Ledger lost 233.46 million XRP, worth approximately $296 million. Solana outflows totaled 970,500 SOL, worth approximately $96 million. Arbitrum, Optimism, and Base accounted for approximately $39 million combined, including 74.6 million ARB moved on Arbitrum. Avalanche outflows were approximately $28 million, and Polygon outflows were approximately $10 million.
How the attack unfolded
Preparations began at least 36 hours before the theft. Starting on the morning of October 28, the attacker’s operational wallets received three small withdrawals from Tornado Cash, a service used to obscure the origins of crypto assets. In the early hours of October 29, the operator deployed the first piece of attack code and tested it on two wallets. Later that day, they rehearsed the final version on a third wallet, then returned the test funds to themselves. Four hours after this rehearsal, the same code was installed on a Binance hot wallet.
The first theft that evening took place on XRP Ledger. Between 20:05 and 20:09 UTC, five Binance wallets transferred 233.46 million XRP to a single attacker address, each wallet retaining only its minimum balance. The XRP has not moved since. Just after 20:10 UTC, Binance wallets on Solana and Optimism followed. At 20:20, a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address, which began splitting the funds into round-numbered 1,000 BTC and 100 BTC amounts in the same block. This technique, known as a “peel chain,” makes the funds harder to track. Less than two minutes later, a Binance hot wallet on Tron sent the attacker 612.7 million USDT and 46.4 million TRX.
How the attacker took over Binance’s hot wallet
A hot wallet is an internet-connected wallet that an exchange uses to process customer withdrawals. The Ethereum hot wallet involved in this case was one of Binance’s best-known wallets.
EIP-7702 was introduced with Ethereum’s Pectra upgrade in May 2025. It allows a regular wallet to delegate its behavior to a smart contract by signing an authorization. Every subsequent call to that wallet then executes the contract’s code, and this arrangement remains in effect until the wallet signs a new authorization.
At 20:20 UTC, the operator submitted a transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweep contract that accepted instructions only from the operator. Every wallet continuously counts its outgoing transactions; this count is called a nonce, and an authorization is valid only if it matches the wallet’s current count at the moment of execution. The Binance hot wallet was continuously processing withdrawals, so its count kept advancing. By preparing signatures for 50 consecutive counts in advance, the attacker ensured that at least one would still be valid when the transaction was executed. One matched, which was all the attacker needed. The signatures had been generated in batches ahead of time.
Three minutes and 24 seconds after the delegation took effect, the operator instructed the Binance hot wallet to transfer its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
The delegation was never revoked. Whenever new funds entered the Binance hot wallet, the operator swept them out again, at 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56 UTC. The wallet also acted as the executor for another Binance smart account, allowing the attacker to withdraw 823 million USDC from it. Circle quickly froze those USDC afterward.
Evidence points to Binance’s signing infrastructure
Early signs of activity on Ethereum suggested that the attacker might have phished the authorizations. But that explanation accounts only for Ethereum activity, not the other chains. Within the same time window, five Binance wallets on XRP Ledger; Binance wallets on Arbitrum, Avalanche, Optimism, and Base; a Binance Bitcoin hot wallet, a Binance Tron hot wallet, and a Binance Solana wallet all transferred funds to the attacker through standard signed transfers. Another Binance hot wallet on Ethereum also transferred 28,006 ETH, 55.7 million USDT, and 25.9 million RLUSD in the same way, without any delegation. About two and a half hours later, at 23:05 UTC, Binance wallets on Avalanche and Polygon followed.
These wallets were on different chains and used different key types and signing schemes. All of them produced valid signatures for the attacker within roughly half an hour. TRM assesses that the most likely explanation is that the attacker gained the ability to make Binance’s hot-wallet signing system sign transactions across chains as instructed. The batch of 50 pre-signed authorizations suggests that this access may have been time-limited or that signatures had to be requested through a system. Binance has not disclosed the root cause.
Stablecoin freezes and asset conversions
Stablecoin issuers acted quickly, and freezes continued to expand throughout the night. At 23:35 UTC, Binance said that confirmed freezes had reached $2.54 billion. Including subsequent freezes, TRM recorded approximately $2.7 billion frozen on-chain as of 00:30 UTC:
Tether, approximately 1.77 billion USDT. At 21:01 UTC, 37 minutes after the main sweep, Tether froze 971.1 million USDT in the primary receiving wallet. All subsequent sweep funds went into this frozen wallet, which currently holds 1.175 billion USDT. Tether also froze 205 million USDT in two other Ethereum wallets belonging to the attacker, 378.7 million USDT in two attacker wallets on Tron, and 8.4 million USDt on Avalanche. Another 6.2 million USDT0 on Polygon was also frozen.
Circle, approximately 825 million USDC. At 21:04 UTC, Circle coordinated with law enforcement to freeze 823 million USDC in the primary receiving wallet. It later froze another 1.56 million USDC that the attacker had obtained by swapping AVAX and bridging from Avalanche to Ethereum.
Ripple, 40.5 million RLUSD. At 22:01 UTC, Ripple froze a wallet holding stolen RLUSD, with 40.5 million of the original 88.5 million RLUSD still inside. It also froze RLUSD in a compromised Binance hot wallet, preventing newly deposited funds from being swept. Binance co-CEO He Yi said Ripple helped stop the transfer of approximately $200 million; TRM has confirmed the freeze of 40.5 million RLUSD on-chain.
World Liberty Financial, 27.8 million USD1. At 22:10 UTC, World Liberty Financial froze 27.8 million USD1 in the primary receiving wallet, then froze USD1 in the compromised Binance hot wallet at 22:26.
Arbitrum Security Council, 8,426 ETH and 74.6 million ARB. The Arbitrum Security Council is a group that can take emergency action on the Arbitrum network. At 00:08 UTC, it used these powers to execute two forced transfers from the attacker’s Arbitrum wallet, moving 8,426 ETH and 74.6 million ARB (approximately $30 million) out of the attacker’s control.
In the first few hours, the attacker accepted steep losses to convert freezeable stablecoins into assets no issuer could reach. Approximately 325 million USDT was sold to professional executors and market makers through UniswapX and other intent-based contracts in exchange for approximately 122,300 ETH. That implies an execution price near $2,650 per ETH, while ETH was trading at $2,300 to $2,350—a discount of more than 10%. The remaining 175 million USDT from this batch was frozen.
The attacker’s second wallet deposited 60 million USDT into lending protocol Aave and borrowed approximately 19,760 ETH against it, after which Aave froze the affected market. On Tron, 300 million USDT was transferred to a wallet that began depositing the USDT into lending protocol JustLend. Another 200 million USDT was swapped on Uniswap through a chain of hop wallets, with 30 million USDT frozen along the way. After two hops, 88.5 million RLUSD entered a wallet that sold 48 million of it on decentralized exchanges between 21:42 and 22:01 UTC, until Ripple froze the remaining 40.5 million.
With ETH concentrated in a handful of wallets and 18,270 BTC moving through peel chains, the attacker controlled approximately $2.4 billion in assets beyond the reach of any issuer. Based on previous large-scale thefts, TRM expects the next phase to involve cross-chain bridges, swap services, and over-the-counter (OTC) brokers. TRM is monitoring the peel-chain output addresses and consolidation wallets to track these movements.
What exchanges and compliance teams should do now
Exchanges and compliance teams should screen deposits and counterparties against the attacker addresses flagged by TRM. Funds from the Bitcoin peel chains and ETH consolidation wallets are likely to flow into exchanges, swap services, and OTC desks in the coming days.
Treasury teams should monitor Ethereum-compatible wallets for EIP-7702 delegations—indicated by code appearing at an address that should not have any. Any such delegation on a treasury wallet should trigger an immediate alert. Teams should have a tested, pre-approved method for signing revocations ready.
Signing policies should reject unexpected EIP-7702 authorizations. Requests for a large number of authorizations covering a range of transaction counts should be treated as a sign of compromise. Signing infrastructure and approval paths should be isolated by chain and wallet tier. In this incident, a single actor obtained valid signatures for wallets on ten chains within a few hours.
Market makers and solvers should screen counterparties before executing large orders. Approximately 325 million USDT was sold to market makers and solvers by a wallet that had received the USDT from the hacker just minutes earlier. Real-time address screening could have flagged it.
Frequently asked questions
What happened at Binance?
On October 29, 2026, an attacker moved approximately $6.36 billion from Binance wallets across ten blockchains: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon. Binance confirmed a security incident and suspended withdrawals on multiple networks.
Who was behind the Binance hack?
Based on reliable on-chain and off-chain intelligence, TRM attributes the Binance hack to the North Korean state-backed hacking group TraderTraitor. The group was also behind the $1.5 billion Bybit theft in February 2025.
What is EIP-7702, and how was it exploited?
EIP-7702 allows a regular Ethereum wallet to execute the code of a smart contract by signing an authorization. The attacker used a pre-signed authorization to make a Binance hot wallet run a sweep contract that only the attacker could call. They then drained the wallet and continued sweeping newly arriving funds.
How much of the stolen crypto has been frozen?
Tether, Circle, Ripple, and World Liberty Financial have frozen approximately $2.67 billion in stablecoins. The Arbitrum Security Council froze approximately $30 million in ETH and ARB, bringing the total to around $2.7 billion. The attacker still controls more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion, as well as smaller amounts of assets on other chains.
How does this compare with other major hacks?
At approximately $6.36 billion, this is the largest cryptocurrency theft on record—about four times the $1.5 billion Bybit theft in February 2025. Even after excluding the frozen stablecoins, the amount currently held by the attacker exceeds that of any previous theft.