Binance transfers reach $6.36 billion in hack described as the largest on record

Key Facts

TRM Labs reported that an attacker transferred nearly $6.36 billion in assets from Binance wallets across 10 networks on October 29, 2026, in an incident the company described as the largest recorded cryptocurrency theft. Most of the transfers were concentrated in about 20 minutes, beginning at 20:05 UTC, making the speed of movement across networks central to tracking the assets and efforts to freeze them. TRM valued the transfers at asset prices at the time of transfer and said the assets themselves were worth about $6.23 billion at the time its analysis was published. The report compared the incident with the $1.5 billion Bybit theft in February 2025, saying the value of the Binance transfers was nearly four times as large. The Federal Bureau of Investigation said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on October 29, and classified the activity as part of the TraderTraitor group.

Ethereum was the largest single route in TRM’s estimates, with transfers of about $3.79 billion, including 200,630 ETH and 185 other tokens. These assets included $1.875 billion in USDT, $823 million in USDC, and $88.5 million in RLUSD. Outgoing transfers through Bitcoin amounted to 18,270 BTC, worth about $1.47 billion. The figures show that the movement was not limited to a single digital asset, but included stablecoins and other assets distributed across multiple networks. The FBI said it had tracked the stolen assets being converted primarily into Ether, with the expectation they would later be used in decentralized finance and instant swap services ahead of further laundering stages.

TRM said the attacker used an EIP-7702 delegation on Ethereum to turn a Binance hot wallet into a transfer tool under the attacker’s control, and prepared 50 pre-signed delegations before executing the transfers. The company said this mechanism pointed to a compromise of the hot-wallet signing infrastructure. In its initial update, Binance said the incident may have involved a compromised laptop that enabled the attacker to access a service container and submit unauthorized withdrawal transactions. The company added that it had found no evidence that private wallet keys had been leaked, but said a subsequent investigation had uncovered additional compromise points. Binance did not detail those points in the update cited by TRM, while the analytics firm said the root cause had not been published when it prepared its report.

In an effort to contain the funds, stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion, according to TRM. The Arbitrum Security Council also froze about 8,426 ETH and 74.6 million ARB on its network. TRM estimated that about $2.4 billion in assets remained beyond the ability of any issuer to freeze, noting that the attacker moved quickly to sell USDT to market makers and borrow ETH against USDT through Aave. On October 30, Binance said about $3 billion had been frozen on-chain by that point; the frozen amount did not mean all transferred assets had been recovered. The platform temporarily suspended withdrawals to conduct security reviews and remediation measures and verify the integrity of affected systems, while deposits and other unaffected services remained operational.

Binance announced on October 30 that it had allocated more than $6.34 billion in company funds, including $5 billion in assets matching the affected tokens, and said this covered about 80% of the affected amount in that update. The company then raised its coverage rate to about 95% in an update on November 1, after saying in an earlier update that it had compensated about 90%. It described the remaining 5% as less liquid tokens outside the top 10 tokens, which would take longer to source. On the same day, Binance announced that the first phase of withdrawals would resume between 06:00 and 09:00 UTC, with the resumption to take place in stages. On November 2, Binance said users could independently verify that their balances in the 10 specified tokens were backed at no less than 1:1, after completion of the zero-knowledge proof for the October 31 proof-of-reserves snapshot.

Net outflows from Binance reached about $3.64 billion, or 2.1% of its assets, after withdrawals resumed, according to Reuters; the figure refers to net flows during the trading window associated with the service reopening, not total withdrawals. The platform said it had also recorded inflows of $2.7 billion since Sunday and that withdrawal volumes had stabilized after the initial surge. Binance had $171 billion in assets under management on October 28 and 335 million registered users globally, according to data cited by Reuters. The agency said the net withdrawals came as an early test of customer confidence, while the combined market capitalization of USDT and USDC had fallen by about $1.2 billion from Friday through its report on November 2. For comparison, Binance processed net outflows of about $6 billion over 72 hours after the collapse of FTX in 2022.

Across the broader market, Bitcoin prices recovered over the weekend after hitting a six-week low on Friday, trading above $77,000 on Monday, November 2, while Ether rebounded from a two-month low, according to Reuters. Spot Bitcoin funds recorded outflows of $643 million on Friday, their largest daily withdrawals in October, alongside liquidations of leveraged positions exceeding $1.3 billion. In the investigation, the FBI and its partners asked operators of THORChain nodes, RPC services, decentralized finance services, instant swaps and virtual asset service providers to block transactions linked to addresses used by TraderTraitor to launder money. Binance said it planned to take another proof-of-reserves snapshot on November 4 covering more tokens, then prepare an updated zero-knowledge proof expected to take about 40 to 50 hours. The coverage rate announced by the company remains about 95%, as it continues to source the less liquid assets that make up the remainder.