• Binance is investigating a record-breaking $6.36 billion cryptocurrency theft after attackers compromised its hot-wallet signing infrastructure across multiple blockchains.
  • TRM Labs and Chainalysis have linked the attack to North Korea’s TraderTraitor group.
  • Binance says it will cover all confirmed losses.

Binance is investigating a cryptocurrency theft estimated at $6.36 billion after attackers drained funds from its hot wallets across multiple blockchains on October 29, 2026, in what blockchain intelligence firm TRM Labs describes as the largest crypto theft on record.

The attack affected Binance wallets across ten blockchain networks, with most of the stolen funds transferred within approximately 20 minutes. Binance initially suspended deposits and withdrawals while investigating the breach, later confirming that deposits remained operational but withdrawals were still paused during security remediation.

TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group. Binance has not independently confirmed the identity of the attackers. The exchange has pledged to cover all confirmed losses using its SAFU fund and corporate resources, while industry partners have helped freeze billions of dollars in affected cryptocurrency.

How the Binance Hack Happened

Binance’s initial investigation suggests that the attackers may have gained access through a compromised laptop belonging to a DevOps engineer. According to the exchange’s October 30 security announcement, the intrusion potentially allowed the attacker to access an internal service container and submit unauthorised withdrawal transactions.

Binance said it had found no evidence that wallet private keys were leaked. However, the exchange has yet to publish its complete technical post-mortem, meaning the precise intrusion method and full sequence of events remain under investigation.

TRM Labs’ blockchain investigation provides further insight into how the funds were moved. On Ethereum, the attacker allegedly exploited EIP-7702, a mechanism that allows an externally owned wallet to delegate transaction execution to smart-contract code. TRM says the attacker used 50 pre-signed authorisations to turn a Binance hot wallet into a wallet-sweeping mechanism under its control.

On the other affected networks, the attacker used ordinary signed transfers. TRM’s analysis suggests that the attackers obtained access to Binance’s hot-wallet signing infrastructure, enabling them to generate valid transactions across multiple chains.

The theft involved Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. TRM estimates that approximately $6.36 billion was transferred to attacker-controlled addresses, valued at the time of the transactions.

Read also: How to Keep Your Crypto Safe: A Practical Guide to Protecting Your Assets

Binance’s Response

Binance has pledged to cover all confirmed losses using its Secure Asset Fund for Users (SAFU) and additional company resources. In its October 30 announcement, the exchange said approximately $3 billion in affected assets had been frozen through cooperation with blockchain partners.

In a subsequent financial update, Binance said it had reserved more than $6.34 billion in company funds to cover the incident.

Approximately $5 billion is already held in the exact token assets affected, while the company is purchasing the remaining amount through market and over-the-counter channels. Binance said acquiring some tokens could take longer because of limited liquidity and OTC settlement requirements.

The recovery effort involves several cryptocurrency companies. Tether reported freezing approximately $1.57 billion, while Circle froze more than $800 million. Ripple also froze approximately $200 million in assets associated with the incident. These figures represent different stages and scopes of the industry’s response; they should not be treated as interchangeable with Binance’s evolving overall frozen-asset estimate.

Binance says it has begun recovering affected assets for users and will continue working with law enforcement, token issuers and blockchain intelligence firms. The company also intends to publish an updated Proof of Reserves after remediation is complete.

However, customer reassurance deserves scrutiny alongside the compensation commitment. CoinDesk’s analysis of Binance’s October 1 reserve data found that some wallets affected by the incident were included in the assets backing customer balances. Its analysis estimated that the loss could temporarily reduce ETH backing from 100% to approximately 94%, before replacement of the missing assets. Binance maintains that user funds are safe and has committed to covering the shortfall.

Deposits have returned to normal, but withdrawals remain suspended while Binance completes its security review. The exchange has indicated that it expects to restore withdrawals within 48 hours, although that remains a target rather than a guarantee.

Who Is Behind the Binance Hack?

Although Binance has not officially identified those responsible, blockchain intelligence firms TRM Labs and Chainalysis have linked the attack to TraderTraitor, a North Korean state-sponsored hacking group associated with the wider Lazarus Group ecosystem.

TRM Labs said its attribution was based on on-chain and off-chain intelligence, expressing high confidence in its assessment. The firm also identified similarities between the Binance incident and previous attacks associated with North Korean hackers. Reuters independently reported the attribution by the blockchain intelligence firms on October 30.

The most significant historical comparison is the February 2025 Bybit hack, in which approximately $1.5 billion in cryptocurrency was stolen. The FBI officially attributed that attack to North Korea’s TraderTraitor group, making it an established example of the group’s involvement in a major cryptocurrency theft.

Another relevant incident is the April 2026 KelpDAO hack, which TRM Labs also associates with North Korean-linked attackers. Its investigation identified similarities in operational preparations and fund movements, although the laundering techniques used in the Binance incident differed from those observed after the Bybit attack.

The Binance theft is significantly larger than the previous Bybit record. At approximately $6.36 billion, TRM’s estimate is more than four times the amount stolen from Bybit.

Read also: Bitget Confirms $351.6 Million Hack from Crypto Wallets

For Binance, the immediate priorities are completing the security investigation, restoring withdrawals and replacing the affected assets. For the wider cryptocurrency industry, the incident raises serious questions about the security of exchange wallet-signing infrastructure, internal access controls and the ability of attackers to exploit trusted operational systems without directly stealing private keys.

Binance says it will publish a detailed technical post-mortem once its investigation is complete. Until then, the precise entry point, full attack sequence and final attribution remain subject to further verification.