Suspicious Transfers from Binance Wallets Reach $6.36 Billion Amid North Korean Attribution

Key Facts

TRM Labs said an attacker moved assets worth about $6.36 billion from Binance wallets to addresses under the attacker’s control across 10 blockchains on October 29, 2026. The company said most of the transfers took place over about 20 minutes, starting at 20:05 UTC. TRM attributed the attack with high confidence to TraderTraitor, a North Korean hacking group, based on on-chain and off-chain information. Binance estimated the incident’s total impact at about $6.3 billion in an update published on October 30, and said about $3 billion had been frozen on-chain by then. Binance did not identify the attacker, and described the event in its statement as a security incident under investigation.

Estimates of the value of the affected assets differ by source and methodology. Chainalysis estimated the amount stolen at the time of the theft at about $5.912 billion, below TRM’s estimate of about $6.36 billion and Binance’s estimate of the incident’s total impact at about $6.3 billion. These figures are not a single unified estimate: TRM referred to transfers from Binance wallets to attacker addresses, while Binance framed its figure as the incident’s total impact. TRM said the incident was the largest cryptocurrency theft it had recorded, at about four times the size of the $1.5 billion Bybit hack in February 2025. The scale puts the incident among the sector’s biggest thefts, according to the comparison cited by the company.

TRM said it attributed the attack specifically to TraderTraitor, which it described as a North Korean hacking unit, while CoinDesk reported that the group is a subunit of Lazarus. Blockchain investigator ZachXBT said the attacker was “likely Lazarus,” but CoinDesk quoted a person familiar with the investigations as saying the attribution to Lazarus was not final. TRM’s assessment was based on on-chain and off-chain information, with a confidence level the company described as high, but it was not an official confirmation of the perpetrator’s identity. The company said similarities with previous attacks included small Tornado Cash withdrawals to fund an operational wallet, preparation that began before the theft, and signatures prepared in advance and executed in one batch. It added that the laundering pattern it observed differed from the bridge-based pattern used in the Bybit hack.

According to TRM, preparations began at least 36 hours before the theft, and the operational wallet received three small withdrawals from Tornado Cash starting on the morning of October 28. The company said the attacker used an EIP-7702 delegation on the Ethereum network to turn a Binance hot wallet into a contract that withdrew funds for the attacker, with 50 pre-signed delegations prepared. Wallets on the other 9 chains sent funds through ordinary signed transfers, TRM said. These details are consistent with the company’s description of advance preparation and signatures executed in one batch. Binance said its initial investigation indicated that a DevOps engineer’s laptop may have been compromised, allowing the attacker to access a service container and submit unauthorized withdrawal transactions.

Binance said it had found no evidence that private wallet keys had been leaked, and that it had temporarily suspended deposits and withdrawals and revoked the authorization for the affected address. It added that it was working with blockchain partners to freeze assets, and that about $3 billion had been frozen on-chain as of its October 30 update. The Associated Press reported that Circle froze the equivalent of more than $800 million linked to the incident in coordination with law enforcement, and that Tether froze the equivalent of more than $1.5 billion. Binance said it would cover losses from its SAFU fund and company funds, saying that “user funds are safe.” It also said it was working with law enforcement and blockchain intelligence partners to address the incident.

The incident weighed on the cryptocurrency market on Thursday evening, with Bitcoin falling 3.2% to below $79,000, according to the Associated Press. In a broader context, a Reuters report said attackers stole $2.9 billion in cryptocurrency through about 150 attacks during 2025. Binance said it expected withdrawal services to resume within the following 48 hours after its report published on October 30. It also pledged to publish a detailed technical review after the investigation was complete and the facts verified, and to issue an update to its proof of reserves after remediation was complete. Binance did not specify a calendar date in its statement for publishing the technical review.