Quick Answer: On October 29, 2026, attackers drained roughly USD 6.36 billion from Binance wallets across ten blockchains, most of it in about 20 minutes. TRM Labs attributes the Binance hack to North Korea's TraderTraitor unit with high confidence. Issuers including Tether and Circle froze about USD 2.7 billion, but the attacker still controls around USD 2.4 billion.
The numbers are large enough to lose their meaning, so here's the short version. This is the largest crypto theft on record, roughly four times the USD 1.5 billion Bybit hack of February 2025. What makes it worth your attention is how it happened. The attacker didn't break a smart contract. Based on the forensic trail TRM Labs has published, the attacker appears to have gained the ability to make Binance's own hot wallet signing system sign whatever it wanted.
What Happened in the First 20 Minutes
The attack started on the evening of October 29, at 20:05 UTC. Binance wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and several other networks sent their balances to addresses controlled by one attacker. A second wave at 23:05 UTC reached wallets on Avalanche and Polygon.
Binance said it was investigating a potential security issue and temporarily suspended withdrawals on several networks as a precaution. It has said user funds are safe. The company hasn't published a root cause yet, so treat any detailed explanation, including this one, as the best current reading of onchain evidence rather than confirmed fact.
Most of the damage landed fast. Five Binance XRP Ledger wallets sent 233.46 million XRP between 20:05 and 20:09 UTC, leaving each with only its minimum balance. At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC, and the attacker began splitting it into round 1,000 BTC and 100 BTC pieces inside the same block. That pattern is a peel chain, a technique that makes funds harder to trace by breaking one large sum into many smaller, untraceable-looking outputs.
The Preparation Started at Least 36 Hours Earlier
Here's what most coverage skips: this wasn't a spontaneous grab. TRM traced the operator wallet receiving three small withdrawals from Tornado Cash starting on the morning of October 28. Tornado Cash is a privacy mixer, and small withdrawals like these are commonly used to fund an operator wallet without linking it to a visible source.
Early on October 29, the operator deployed attack code and tested it on two wallets. Later that day, it rehearsed the final version on a third wallet and routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.
The same playbook appeared in earlier North Korea-linked heists. TRM points to the Bybit hack and the KelpDAO hack in April 2026, which shared three traits: Tornado Cash funding, staging well before the theft, and signatures collected in advance and executed in a single burst. If you're building detection, that pre-attack staging is the window you have. Most monitoring looks only at the moment of theft, which is too late.
How a Hot Wallet Got Hijacked
A hot wallet is a wallet connected to the internet that an exchange uses to process customer withdrawals. It has to be online, which makes it a bigger target than cold storage.
On Ethereum, the mechanism was EIP-7702, introduced in the Pectra upgrade in May 2025. It lets an ordinary externally owned account sign an authorization that hands its code behavior to a smart contract. Until the account signs a new authorization, every call runs that contract's logic.
Here's the clever part. Every wallet has a nonce, a running transaction counter. An authorization only works at the nonce the wallet has reached when it executes. A busy exchange wallet's nonce keeps moving, so the attacker signed 50 authorizations covering 50 consecutive nonce values in advance. One matched, which was all the attacker needed. Three minutes and 24 seconds after the delegation, the operator swept the wallet's entire balance: 167,464 ETH and 63 tokens, including 1.615 billion USDT.
This is the counter-intuitive finding that matters most. Most people assume a wallet signature is a hard security boundary. Here, the signatures were valid, produced in advance and batched. The control problem wasn't the cryptography. It was who could request and release signatures.
Why Ethereum Doesn't Explain the Whole Attack
It's tempting to stop there and blame a phishing attack on delegation approvals. The problem is that the other chains don't fit that story.
In the same window, Binance wallets on the XRP Ledger, Arbitrum, Avalanche, Optimism, Base, Bitcoin, Tron and Solana sent funds through ordinary signed transfers. These chains use different key types and signing schemes. A phished Ethereum authorization can't explain valid signatures on Bitcoin and Tron.
TRM's assessment is that the attacker likely gained control over Binance's hot wallet signing system. That's a different class of failure. It points to infrastructure, such as signing services, key management or access controls, rather than a single user's approval. The batch of pre-signed authorizations also suggests the access may have been time-limited, or that signatures had to be requested through a system the attacker could reach.
Practitioners should note the caveat here. This is an inference from onchain behavior. Until Binance publishes a root cause, the exact entry point remains unconfirmed.
Stablecoin Freezes Chased a Moving Target
Stablecoin issuers moved fast, but the attacker moved faster in the first hours. TRM counts about USD 2.7 billion frozen onchain as of 00:30 UTC on October 30:
| Issuer or entity | Frozen amount | Key detail |
|---|---|---|
| Tether | ~1.77 billion USDT | Froze 971.1 million USDT at 21:01 UTC, 37 minutes after the main sweep |
| Circle | ~825 million USDC | Froze 823 million USDC at 21:04 UTC, in coordination with law enforcement |
| Ripple | 40.5 million RLUSD | Froze the wallet holding the stolen RLUSD at 22:01 UTC |
| World Liberty Financial | 27.8 million USD1 | Froze the main receiving wallet at 22:10 UTC |
| Arbitrum Security Council | 8,426 ETH and 74.6 million ARB | Forced transfers out of the attacker's wallet at 00:08 UTC |
The timing is the lesson. The attacker sold about 325 million USDT to market makers through UniswapX and other intent-based contracts for roughly 122,300 ETH. That implies a price near USD 2,650 per ETH when the market traded around USD 2,300 to 2,350, a discount of more than 10%. The attacker paid that premium to escape freezes, which shows how much value issuers' freezes can still protect when they act quickly.
What This Means for Exchanges and Compliance Teams
Here's where it gets practical. The attack exposed three gaps that apply well beyond Binance:
- Signing infrastructure is the real perimeter. Hardware security modules and multi-party approval workflows matter more than wallet-level controls alone. Check whether a single compromised service can request signatures across many chains.
- Pre-attack staging is detectable. Small mixer withdrawals and test runs on side wallets preceded the theft by more than a day. Screening inbound funds to operator wallets gives you a window that post-theft monitoring doesn't.
- Freezes depend on speed and coordination. Issuers froze most of the stolen stablecoins, but only after the sweeps. Standing relationships with issuers and law enforcement shorten that gap.
TRM is labeling attacker addresses and monitoring the peel chain outputs and consolidation wallets. Based on previous large thefts, it expects the next stage to involve cross-chain bridges, swap services and over-the-counter brokers. That's the layer where compliance teams should focus their screening next.
Frequently Asked Questions
How much did North Korea steal from Binance?
Roughly USD 6.36 billion, valued at the prices when assets were taken. At current prices the same assets are worth about USD 6.23 billion. TRM traced transfers across ten blockchains, with Ethereum accounting for about USD 3.79 billion. Figures may change as the investigation develops.
What is a hot wallet, and why was it targeted?
A hot wallet is an internet-connected wallet an exchange uses to process withdrawals. It must stay online to send funds, so it's a larger target than cold storage. Attackers who control its signing system can move its full balance without needing customer credentials.
Can frozen stablecoins be recovered after a hack like this?
Some can. Tether, Circle, Ripple and World Liberty Financial froze about USD 2.7 billion in stablecoins, and Arbitrum's Security Council forced transfers of ETH and ARB. Frozen funds typically depend on issuer policy and legal process, and recovery is not guaranteed for assets the attacker has already converted.
Why is the Binance hack bigger than the Bybit hack?
The Binance theft moved about USD 6.36 billion, roughly four times the USD 1.5 billion Bybit hack of February 2025. The attacker spread the theft across ten blockchains, and the Ethereum component alone exceeded the entire Bybit loss.
Crypto security teams can't rely on the assumption that a signature proves legitimacy. The Binance hack shows that signing systems, time-limited authorizations and multi-chain access controls need the same scrutiny as the code they protect. Review who can request signatures from your hot wallets, and check whether a single service can sign across every chain you operate on. Pass this to anyone running exchange or custody infrastructure who's still treating signing as a solved problem.