Binance hack: How North Korean-linked hackers stole billions with $3 billion frozen

Binance is investigating a major security breach after approximately $6.36 billion was moved from its cryptocurrency wallets across 10 blockchain networks in what the crypto trading platform has described as the largest cryptocurrency theft on record.

Blockchain intelligence reports have attributed the October 29, 2026, attack to TraderTraitor, a North Korean state-sponsored hacking group previously linked to major cryptocurrency thefts, including the $1.5 billion Bybit hack in February 2025.

According to a report by TRM Labs, the suspected attackers moved most of the funds within approximately 20 minutes, triggering an international response involving cryptocurrency companies, blockchain security teams and law enforcement agencies.

In its latest update, Binance said deposits were operating normally but withdrawals remained temporarily suspended as it undertook a security overhaul.

The exchange expects to resume withdrawals within 48 hours, subject to the completion of security checks.

Binance also maintained that users' funds were safe and promised to cover all losses arising from the incident.

In an initial investigation, Binance said the incident may have involved a compromised laptop belonging to a DevOps engineer, allowing an attacker to access a service container and submit unauthorised withdrawal transactions.

The company said it had found no evidence that wallet private keys had been leaked.

"Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," the exchange stated.

However, Binance cautioned that investigators were still tracing the full attack path and had not established the definitive cause.

The exchange said it would publish a detailed technical post-mortem after the investigation was complete and the findings had been verified.

Blockchain intelligence firm TRM Labs' analysis indicates that the attackers moved funds from Binance wallets across Ethereum, Bitcoin, Tron, the XRP Ledger, Solana and other networks.

The firm said the transactions began at approximately 20:05 UTC on October 29, with the bulk of the transfers occurring within 20 minutes. A subsequent wave of outflows followed later that evening.

On Ethereum, TRM identified the use of EIP-7702, a feature that allows an ordinary cryptocurrency wallet to temporarily execute smart-contract code through a signed authorisation.

The attackers allegedly used pre-signed authorisations to turn a Binance hot wallet into a mechanism that automatically transferred funds to addresses they controlled.

TRM said the arrangement also enabled repeated transfers as additional funds entered the affected wallet.

TRM Labs attributed the operation to TraderTraitor, a hacking group associated with North Korea, based on what it described as strong on-chain and off-chain intelligence.

The blockchain intelligence firm said the attack shared characteristics with previous operations linked to the group, including the preparation of transactions in advance and the use of cryptocurrency mixing services to fund wallets involved in the operation.

TraderTraitor was also identified by the FBI in connection with the February 2025 Bybit cryptocurrency theft, in which approximately $1.5 billion was stolen.

However, Binance has not publicly confirmed the identity or nationality of the attackers.

Its latest statements say it is working with law enforcement partners to establish who was responsible.

The breach prompted cryptocurrency companies and blockchain networks to move against addresses associated with the stolen assets in an effort to prevent further transfers.

Binance's latest published figure put the verified amount frozen at approximately $3 billion, although it said the figure could increase as investigations and recovery efforts continued.

"The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete."

TRM Labs separately estimated that approximately $2.7 billion had been frozen through the intervention of stablecoin issuers and blockchain security teams.

The firms involved include Tether, Circle, Ripple and World Liberty Financial, alongside Arbitrum's Security Council.

Tether and Circle accounted for substantial portions of the frozen funds, with the companies using their ability to restrict transactions involving certain stablecoins.

Arbitrum's Security Council also used emergency powers to move cryptocurrency assets out of an attacker-controlled wallet.

Despite the intervention, TRM Labs estimated that approximately $2.4 billion remained beyond the reach of the entities involved in the freezes.

The intelligence firm said the attackers had attempted to convert some of the stolen stablecoins into other cryptocurrencies, including Ether, through trading and lending platforms to avoid restrictions imposed on certain assets.

On its part, Binance said it would use its Secure Asset Fund for Users (SAFU) and company funds to cover losses arising from the incident.

"Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe," the exchange stated.

SAFU is Binance's emergency reserve established to protect users in exceptional circumstances.

The centralized cryptocurrency exchange also said it had revoked the authorisation associated with the affected address and engaged law enforcement agencies and blockchain intelligence partners to trace and recover the assets.

Binance initially suspended deposits and withdrawals as a precaution while security checks were conducted.

However, in its subsequent service update, the exchange clarified that deposits remained unaffected and were operating normally.

Withdrawals, on the other hand, remained paused as the company worked on what it described as a security revamp of the withdrawal service and related addresses.

"We expect to resume within 48 hours, and will update with further details," Binance said.

The crypto trading platform also committed to publishing an updated Proof of Reserves after completing the remediation process. Proof of Reserves is a disclosure used by cryptocurrency exchanges to demonstrate the assets held against customer balances.

If the figures reported by TRM Labs are confirmed, the Binance incident would exceed previous major cryptocurrency thefts, including the February 2025 Bybit breach.

The scale of the incident has also raised questions about the security of cryptocurrency exchanges' internal systems, particularly the infrastructure used to authorise transactions across multiple blockchain networks.

Although Binance said it had found no evidence of a private key leak, the suspected compromise of an employee's computer and access to a service container has placed attention on the security of the systems connecting employees, software services and digital asset wallets.

The exchange has urged users to rely on its official communication channels for updates and warned against fraudulent messages, links or requests for account information.

However, it has yet to release its full technical report explaining how the attackers gained access and how the security weaknesses will be addressed.