On October 29, 2026, cryptocurrency exchange Binance suffered what is now confirmed as the largest digital theft in history. In roughly twenty minutes, an attacker drained approximately $6.3 billion from hot wallets spanning ten separate blockchains — Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. Blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack with high confidence to TraderTraitor, a North Korean state-backed cybercrime unit previously linked to the $1.5 billion Bybit hack of February 2025.
The scale is staggering. The previous record holder, the Bybit exploit, was less than a quarter of this haul. Within hours, stablecoin issuers and law enforcement had frozen close to $3 billion, but more than $2.4 billion in ETH and BTC remains in attacker-controlled wallets, beyond the reach of any centralized freeze.
How It Started: One Laptop, Ten Chains
According to Binance CEO Richard Teng, the breach began with a compromised DevOps engineer’s laptop. That single foothold gave the attacker access to an internal service container with withdrawal capabilities. Teng was careful to note that the attack was not “a single one-click action” — additional breach points were discovered as the investigation unfolded — and that Binance found no evidence of a leaked wallet private key.
Instead, the attacker appears to have compromised Binance’s hot wallet signing infrastructure itself, gaining the ability to produce valid signed transactions across multiple blockchains. The preparation was meticulous. Starting October 28, the attacker received small Tornado Cash withdrawals to fund an operator wallet. Early on October 29, they deployed and tested sweeper code against test wallets, rehearsed the final version, and routed test funds back through the system — all before the real attack began.
The Twenty-Minute Heist
The main event began around 20:05 UTC on October 29. The timeline, reconstructed by TRM Labs, reveals a choreographed multi-chain blitz:
20:05–20:09 UTC: Five Binance XRP Ledger wallets sent 233.46 million XRP, draining each to its minimum reserve balance — roughly $296 million gone in four minutes.
After 20:10: Binance wallets on Solana ($96 million in SOL) and Optimism were emptied via ordinary signed transfers.
20:20 UTC: The Ethereum attack launched. The attacker submitted a single transaction containing 50 pre-signed EIP-7702 authorizations — a feature introduced in Ethereum’s Pectra upgrade that allows externally owned accounts to temporarily delegate execution to smart contract code. One authorization matched the hot wallet’s current nonce, installing a sweeper contract that accepted instructions only from the attacker’s operator address. In the same window, a Binance Bitcoin hot wallet sent 18,270 BTC ($1.47 billion), which the attacker immediately split through a peel chain within the same block.
Within two minutes of the Ethereum delegation: A Tron hot wallet transferred 612.7 million USDT and 46.4 million TRX ($628 million total).
Three minutes and twenty-four seconds after delegation: The Ethereum hot wallet’s entire balance was swept — 167,464 ETH plus 63 different tokens, including 1.615 billion USDT and 823 million USDC from a connected smart account. Total Ethereum losses reached approximately $3.79 billion.
The attacker continued running sweeps at 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56 UTC, capturing newly deposited user funds as they arrived. A second wave at 23:05 drained wallets on Avalanche ($28 million) and Polygon ($10 million).
The Race to Freeze
The industry’s response was fast, but the attacker was faster in several critical areas. By 00:30 UTC on October 30 — roughly four hours after the first transfers — approximately $2.7 billion had been frozen across multiple parties. Tether blacklisted about 1.77 billion USDT across wallets on Ethereum, Tron, Avalanche, and Polygon, with the single largest freeze hitting the main receiving wallet 37 minutes after the initial Ethereum sweep. Circle froze approximately 825 million USDC in coordination with law enforcement. Ripple froze 40.5 million RLUSD, and World Liberty Financial froze 27.8 million USD1. The Arbitrum Security Council took the extraordinary step of force-moving 8,426 ETH and 74.6 million ARB tokens (roughly $30 million) out of the attacker’s Arbitrum wallet.
But the attacker had already begun laundering at speed. Chainalysis tracked roughly $325 million in stablecoins swapped for about $285 million in ETH through UniswapX in less than twenty minutes — accepting a discount of more than ten percent to convert assets into forms that cannot be unilaterally frozen. Another 60 million USDT was supplied to Aave as collateral to borrow approximately 19,760 ETH, and on Tron, 300 million USDT was deposited into JustLend. Thousands of automated transactions circulated funds through hop wallets, with some deliberately routed back to earlier addresses to complicate tracing.
Why This Points to North Korea
Both TRM Labs and Chainalysis attributed the hack to TraderTraitor with high confidence, and the attribution came remarkably quickly — Chainalysis announced its assessment by 12:30 a.m. ET on October 30, less than eight hours after the first unauthorized transfer.
The evidence is multi-layered. The on-chain pattern — Tornado Cash funding, rehearsal transactions, multi-chain simultaneous drains, and rapid conversion of freezable stablecoins to non-freezable native tokens — closely mirrors the playbook used in the Bybit hack, which the FBI attributed to TraderTraitor. But the strongest signal was real-time commingling: Chainalysis observed Binance-stolen funds being mixed with proceeds from the Bitget exchange exploit from September 2026, which had already been independently attributed to North Korean actors. TRM Labs also noted structural similarities to the April 2026 KelpDAO hack.
North Korea’s crypto theft apparatus has escalated dramatically. The Ronin Bridge hack in 2022 netted $620 million. Bybit yielded $1.5 billion. This attack, at more than four times Bybit’s scale, suggests that the regime’s offensive cyber capabilities have outpaced the industry’s defensive measures by a widening margin.
What Comes Next
Binance has pledged to cover all customer losses using its SAFU (Secure Asset Fund for Users) insurance fund and company reserves. CoinDesk reported that Binance has arranged $6.34 billion to make affected users whole. Withdrawals, suspended since the attack, are expected to resume within 48 hours of the breach.
The more difficult challenge is recovery. More than 420,000 ETH and 18,270 BTC — roughly $2.4 billion — sit in attacker-controlled wallets that no issuer can freeze. TRM Labs expects the funds to move through bridges, swap services, and OTC brokers in the coming weeks and months, following the same slow-burn laundering pattern seen after previous North Korean operations.
For the broader industry, this attack exposes several uncomfortable truths. EIP-7702, designed to improve Ethereum’s account abstraction capabilities, became the attack’s sharpest tool on its most valuable chain. TRM Labs recommends that exchanges monitor treasury wallets for unexpected EIP-7702 delegations, treat multiple authorization requests across a range of nonces as a compromise indicator, and maintain pre-approved revocation procedures. More fundamentally, the attack demonstrates that a single compromised workstation — one laptop with the right access — can cascade into billions of dollars in losses when signing infrastructure lacks sufficient segmentation between chains and wallet tiers.
The investigation remains active, with Chainalysis updating its attacker address labels as funds continue to move. For anyone operating exchange infrastructure, the takeaway is blunt: if your hot wallet signing system treats ten blockchains as one trust domain, an attacker will too.
Leave a Reply