TRM estimates $6.36 billion transferred from Binance wallets across 10 networks
Key Facts
TRM Labs estimated that about $6.36 billion left wallets attributed to Binance across 10 blockchain networks on October 29, 2026, in what it described as the largest cryptocurrency theft it has recorded. Most of the transfers took place over about 20 minutes, beginning at 20:05 UTC. Binance said its preliminary investigation points to a security incident that may have involved a compromised laptop belonging to an engineer on its DevOps team. The company put the total impact at about $6.3 billion and said about $3 billion had been frozen on-chain. The transfer estimates are attributed to TRM, while Binance provided its own estimate of the impact and frozen assets.
The incident extends beyond the XRP transfers cited in the initial account: TRM said the funds moved across 10 networks and estimated transfers on the Ethereum network at about $3.79 billion. Those transfers included 200,630 ETH, along with 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD. On the Bitcoin network, the company detected 18,270 BTC leaving, worth about $1.47 billion at the time of transfer. The figures reflect a broad distribution of assets across different networks and tokens, rather than an incident limited to one asset. TRM estimated the value of the transfers when they were made, so the asset figures should be read on that valuation basis.
Binance told The Associated Press that its preliminary investigation suggests a DevOps engineer’s laptop was compromised, which may have allowed the attacker to access a service container and send unauthorized withdrawal transactions. The company added that it had found no evidence that wallet private keys had been exposed. In its statement, Binance said user funds were safe and that it would cover all losses from its SAFU fund and company funds. It also announced a temporary suspension of deposits and withdrawals while it addressed the incident, and said it would publish an updated proof of reserves after remediation was complete. The possibility of a laptop compromise remains part of the preliminary investigation, which the company has not said is complete.
Estimates of the frozen assets varied by source and timing. The company estimated the total frozen assets at about $2.7 billion. The Associated Press, citing officials at the two companies, reported that Circle had frozen more than $800 million in currencies linked to the incident and Tether had frozen more than $1.5 billion. Binance, for its part, said about $3 billion had been frozen on-chain. The differences reflect variations in the timing of estimates and which entity counted the assets, rather than a single figure announced by all parties.
TRM linked the attack to North Korea’s TraderTraitor group and estimated that the incident was about four times larger than the Bybit hack, which was valued at $1.5 billion in February 2025. The company said the scale made it the largest cryptocurrency theft it had recorded. In market moves, Bitcoin fell 3.2% to below $79,000 on Thursday evening amid reports of the incident, according to The Associated Press. The comparison with Bybit puts the estimated losses in the context of previous thefts of this kind, while Bitcoin’s move describes the market response that evening. The evidence cited no other price movement that could be directly attributed to the incident.
Binance said it was working with blockchain partners to track and recover the assets, and would publish a detailed technical report after the investigation and full verification of the facts. It also said it was cooperating with law enforcement and blockchain intelligence partners. TRM expects the next stage of asset movement to involve cross-chain bridges, swap services and over-the-counter brokers. It added that it was monitoring Bitcoin network outflows and the wallets where ETH had been consolidated. The technical report remains Binance’s stated next step, while TRM tracks asset flows it expects to appear in those services.