An attacker stole approximately $6.36 billion from Binance wallets across ten networks in the largest cryptocurrency theft on record. The activity began on October 29 and, according to TRM Labs, most of the money was moved in about 20 minutes. Binance says its users’ funds are safe and has committed to covering the losses.
The investigation has not yet publicly established who carried out the attack or how they gained access. Binance said its initial analysis pointed to a compromised DevOps engineer’s laptop, but it later found other points of intrusion. The company has not attributed responsibility to any employee and says it has found no evidence that private keys to its wallets were leaked.
Ten networks and a breach in the signing system
The transfers affected Binance wallets on networks including Ethereum, Bitcoin, Tron, XRP Ledger, and Solana, as well as Arbitrum, Avalanche, Optimism, Base, and Polygon. TRM estimates that the transferred assets were worth about $6.36 billion at each token’s price at the time of the theft; at later prices, the figure fell to about $6.23 billion.
Binance’s initial explanation focused on a compromised laptop that allegedly allowed the attacker to enter a service container and send unauthorized withdrawal transactions. However, the fact that wallets on different networks and with different signing systems produced valid transactions led TRM to point to broader access: the infrastructure that signs transactions for Binance’s hot wallets.
TRM detailed a specific mechanism on Ethereum. The attacker allegedly used an EIP-7702 authorization to make a hot wallet execute a contract under their control and send its funds to another address. The signature was prepared in advance; afterward, the attacker swept funds that arrived in that wallet. On other chains, the assets were moved through conventional signed transfers.
On X, Binance co-CEO Richard Teng rejected the idea that this was a simple operation based on one person’s permissions: “it wasn’t a one-click action,” he said, describing a more complex attack process. Binance has revoked the authorization for the affected address and temporarily suspended deposits and withdrawals while it carries out security checks.
Frozen funds and TRM’s attribution
Binance reported that around $3 billion of the affected assets had been frozen. TRM estimates the total at nearly $2.7 billion, including funds immobilized by stablecoin issuers and the Arbitrum Security Council. The figures reflect different tracking snapshots: TRM put its estimate at around 00:30 UTC on October 30.
Tether, Circle, Ripple, and World Liberty Financial froze stablecoins linked to the theft. The Arbitrum Security Council also intervened to move 8,426 ETH and 74.6 million ARB beyond the attacker’s reach. Even so, TRM estimates that the attacker retains more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion, as well as smaller amounts in other assets.
To convert some of the funds, the attacker sold USDT to market makers and used Aave to borrow ETH against USDT. TRM says these moves allowed the attacker to exchange assets that could be frozen for others beyond an issuer’s reach. The firm expects tracking to continue through exchange services, cross-chain bridges, and over-the-counter operators, although this is a forecast based on previous thefts, not confirmation of future movements.
TRM attributes the attack to TraderTraitor, a North Korean group, based on on-chain and off-chain intelligence. Binance, meanwhile, is still working with law enforcement to confirm the identity of those responsible and has not publicly endorsed that attribution. TRM has also linked the group to the February 2025 Bybit theft, valued at $1.5 billion, which had previously ranked as the largest known cryptocurrency theft.
“The investigation has not attributed responsibility to any individual. So far, we have found no evidence that any private wallet keys were leaked.”
— Richard Teng, Binance co-CEO
Binance promises to cover the losses
In addition to saying that users’ funds are safe, Binance has set aside more than $6.34 billion of its own funds to respond to the incident. The company said that $5 billion of this amount is already held in the same types of tokens that were affected. It also has the SAFU reserve fund, valued at about $1.3 billion in its latest valuation, intended to protect users’ assets in situations like this.
The company plans to publish a detailed technical analysis once the investigation is complete and the facts have been verified. It has also said it will update its proof of reserves once remediation is complete. For now, the central question remains how the attacker got wallets across ten networks to sign transactions under their control.
Sources: The Verge, PC Gamer, TechCrunch, TRM Labs
