Hackers tied to North Korea stole roughly $6.36 billion from Binance on Wednesday, stripping the world's largest cryptocurrency exchange of funds across ten blockchains in a heist that blockchain intelligence firms are calling the largest crypto theft in history.
The attack, which began at 8:05 p.m. UTC on October 29, moved faster than most exchange security teams could respond. The bulk of the money was gone within 20 minutes.
Binance suspended deposits and withdrawals shortly after detecting the breach and said user funds would be covered in full. "Investigating a potential security issue," the exchange wrote in an early-evening post, adding that user assets were safe. By late that night, a coalition of blockchain infrastructure firms had frozen roughly $3 billion of the stolen assets, though more than $2.4 billion remained in the attacker's control as of press time.
How They Got In
Blockchain intelligence firm TRM Labs, which traced the attack in near real-time, said the intrusion bore the hallmarks of TraderTraitor, the North Korean state-sponsored hacking unit that the FBI also attributed to February's $1.5 billion Bybit breach.
The preparation started at least 36 hours before the theft. TRM Labs found that the attackers funded an operator wallet with small withdrawals from Tornado Cash, a crypto mixing service, then ran test transactions across wallets they controlled. In the day before the main theft, the attackers rehearsed the final version of their code on a third wallet before installing it on a live Binance hot wallet.
The technical method on Ethereum was particularly precise. The attackers used EIP-7702, an account delegation feature introduced in a recent Ethereum upgrade, to effectively convert a Binance hot wallet into a sweeper they controlled. A single transaction carried 50 pre-signed authorizations; one matched the wallet's transaction count exactly, granting the attackers the ability to sweep new incoming deposits for hours after the initial theft, all the way until 11:56 p.m. UTC.
On nine other blockchains, including Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, and several Ethereum layer-2 networks, wallets sent funds through standard signed transfers during the same window. TRM's analysis concluded the most likely explanation was that the attacker had somehow obtained the ability to instruct Binance's hot wallet signing infrastructure to authorize transactions of their choosing. Binance has not yet published a root cause analysis.
What Was Taken
The breakdown by chain is staggering. Ethereum accounts for the largest slice: about $3.79 billion, including 200,630 ETH and roughly 1.875 billion USDT. Bitcoin follows with 18,270 BTC worth approximately $1.47 billion. Tron contributed about $628 million, primarily USDT, and XRP Ledger added 233 million XRP worth around $296 million. The remaining losses were spread across Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.
At those figures, the theft dwarfs every previous crypto hack on record by a considerable margin. The Bybit breach in February 2025, which itself broke every prior record, involved $1.5 billion. This attack is roughly four times larger.
The Freeze Race
Within hours of the theft, stablecoin issuers and blockchain governance bodies began freezing assets. Tether moved first, blacklisting 971 million USDT across wallets traced to the attacker at 9:01 p.m. UTC. Circle followed three minutes later with a freeze on $823 million in USDC, acting in coordination with law enforcement. Ripple froze 40.5 million RLUSD at 10:01 p.m. The Arbitrum Security Council executed forced transfers of 8,426 ETH and 74.6 million ARB tokens after midnight.
By 11:35 p.m. UTC, Binance said the verified total of frozen assets had reached $2.54 billion. TRM Labs placed the figure closer to $2.7 billion by 12:30 a.m. the following morning.
The attacker, however, moved quickly to convert portions of the stolen funds. Some USDT was swapped for ETH at a discount of more than 10%, and the attacker used Aave, a decentralized lending protocol, to borrow ETH against frozen stablecoin positions. As of the morning of October 30, the attacker still held more than 420,000 ETH and all 18,270 BTC, assets beyond the reach of any issuer's freeze function.
North Korea's Crypto Playbook
The FBI said it was aware of the incident and working with partners to assess the activity. The U.S. Secret Service had not responded to a request for comment at time of publication.
The timing fits a pattern that intelligence analysts have tracked closely. Chainalysis reported that North Korean operatives stole about $2 billion in cryptocurrency throughout 2025. TRM Labs found that two North Korea-linked groups accounted for three-quarters of all crypto hack losses in the first quarter of 2026 alone. The funds are widely believed to support Pyongyang's weapons programs, which have been cut off from conventional financial markets through international sanctions.
TRM Labs said it expects the attacker to route remaining funds through cross-chain bridges, swap services, and over-the-counter brokers in the coming weeks, and said it was monitoring those flows in real time.
