Record Crypto Heist: Binance Estimates $6.3 Billion Hit as North Korea's TraderTraitor Is Suspected

This is a developing story and will be updated as Binance publishes its post-mortem.

Binance, the world's largest cryptocurrency exchange by trading volume, has been hit by what may be the largest crypto theft on record.

In a statement on X early on October 30, Binance put the "estimated total impact" of the incident at around $6.3 billion, according to FinanceFeeds and Reuters. The exchange says about $3 billion of the affected assets has been frozen with the help of blockchain partners, and that it will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds.

What happened at Binance? #

On the afternoon of October 29 (US Eastern time), large amounts of crypto began leaving Binance hot wallets, the internet-connected wallets exchanges use for day-to-day withdrawals.

Blockchain intelligence firm TRM Labs says an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, "most of it in about 20 minutes," measured at asset prices at the time of each transfer. TRM says the haul included about 167,464 ETH from Binance's Ethereum hot wallet, 18,270 BTC and about 233 million XRP.

Binance first said it was investigating "a potential security issue" and suspended withdrawals on multiple networks as a precaution, according to TechCrunch. Co-CEO Yi He later said deposits and withdrawals were temporarily suspended, that Binance would "cover all losses," and that it was working with law enforcement, according to CoinDesk's live coverage. Binance has not given a date for restoring normal operations.

How did the attackers get in? #

Binance has given an early explanation. In a post on X, it said its initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop," which let an attacker reach a service container and submit unauthorized withdrawal transactions. Binance says it has found no evidence of any wallet private key leak, and has promised a detailed technical post-mortem.

TRM Labs' on-chain analysis adds detail. On Ethereum, TRM says the attacker used an EIP-7702 delegation: the operator had prepared 50 pre-signed authorizations, one of which matched a valid wallet nonce, turning a Binance hot wallet into an attacker-controlled "sweeper." Other chains saw ordinary signed transfers in the same window, which TRM says points to "a compromise of Binance's hot wallet signing infrastructure." TRM also says preparation began at least 36 hours earlier, with small Tornado Cash withdrawals funding an operator wallet.

AppSecNews could not open Binance's original X post directly; its statements are attributed here to coverage by CoinDesk, FinanceFeeds and Reuters.

How much was stolen, and how much is frozen? #

Estimates have shifted as the incident unfolded. Treat these as point-in-time figures from different sources:

Several stablecoin issuers and networks froze funds tied to the attacker, according to TRM Labs and the companies' public statements:

Figures from the issuers themselves differ by timing. Tether CEO Paolo Ardoino said Tether froze more than $1.57 billion in USDT, and Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC, according to CoinDesk. A freeze blocks funds from moving but does not return them to Binance.

TRM says the attacker has been converting freezable stablecoins into assets without issuer controls, including selling about 325 million USDT for ETH through Uniswap and borrowing about 19,760 ETH from Aave against stolen USDT. Aave froze the affected markets, according to TRM.

Who is behind the Binance hack? #

Binance has not attributed the attack. Several blockchain analysis firms point to North Korea:

• TRM Labs attributes the attack to TraderTraitor, which it calls North Korea's elite hacking unit, saying: "We make this judgment with high confidence," based on on-chain and off-chain intelligence.
• Chainalysis CEO Jony Levin said the firm assessed the hack "was likely done by DPRK group TraderTraitor," according to CoinDesk.
• ZachXBT, a blockchain investigator, said the attacker was "likely Lazarus."
• Blockaid CEO Ido Ben-Natan told CoinDesk the tactics were consistent with past North Korean operations.

The FBI previously linked TraderTraitor to the February 2025 Bybit hack of about $1.5 billion. TRM says the Binance theft is about four times larger and shares features such as pre-staged operations and advance signatures, though the laundering pattern so far is different. No government agency has publicly attributed the Binance incident.

What was the market impact? #

Crypto prices fell as news spread. According to CoinDesk, by late October 29 US time bitcoin was down about 5% over 24 hours to just under $77,000, ether fell 5.7% and Binance's BNB token dropped 8.2%.

What should Binance users and crypto platforms do? #

1. Use only official channels. Binance warned users to "remain cautious of scams" and not to trust unofficial links, messages or requests for account information. Expect phishing that pretends to offer refunds or early withdrawals.
2. Wait for official updates on withdrawals. Binance says withdrawals will resume once the security issue is resolved; it has not given a timetable.
3. Secure your account. Turn on phishing-resistant sign-in such as passkeys or hardware keys, and review API keys and withdrawal allowlists.
4. Protect engineer endpoints. Binance's early finding points to a single DevOps laptop. Treat developer and operations machines with access to production signing systems as crown-jewel assets.
5. Separate signing from operations. Hot-wallet signing services should not be reachable from general-purpose service containers, and large withdrawals should need independent approval.
6. Monitor EIP-7702 delegations. Exchanges and custodians should alert on unexpected delegations or authorizations on hot wallets, given TRM's account of how the Ethereum wallet was swept.