The question after Binance's reported $6.36 billion hack is no longer only how the funds left, but who may have orchestrated it. TRM Labs attributes the operation with high confidence to TraderTraitor, a North Korea-linked unit. That is a serious intelligence assessment, not yet an official attribution by Binance or a government agency.
Key points
- TRM says onchain and offchain intelligence points to North Korea-linked TraderTraitor.
- About $6.36 billion moved from Binance wallets on ten blockchains, mostly within roughly 20 minutes.
- Preparation wallets, test deployments, pre-signed authorisations and parallels with previous DPRK-linked operations form part of the attribution case.
- Binance says its investigation found additional breach points beyond the initially suspected employee laptop and no evidence of leaked wallet private keys.
- The identity of the attacker remains under investigation.
What changed after the first Binance update
Binance initially said a compromised DevOps engineer's laptop may have allowed access to a service container and unauthorised withdrawals. Its subsequent incident update said investigators had found additional points of breach. The attack should therefore not be reduced to a single employee device.
ABC News and Reuters moved the story forward by examining attribution. They reported that TRM Labs and Chainalysis both saw evidence consistent with a North Korean operation. Binance has not publicly named the group, and the investigation remains open.
Who is TraderTraitor?
TraderTraitor is an industry label for North Korea-linked cyber activity targeting cryptocurrency companies. Government and private-sector reporting often discusses it alongside Lazarus Group, APT38, BlueNoroff and Stardust Chollima, although those labels do not always describe identical organisational boundaries.
A joint FBI, CISA and US Treasury advisory warned that the actors use social engineering and trojanised applications to target exchanges, DeFi protocols, gaming companies, investment firms and large individual holders. The FBI formally attributed the 2025 Bybit theft to North Korean actors.
Why TRM points to TraderTraitor
TRM Labs says its conclusion is based on robust onchain and offchain intelligence. Publicly described indicators include:
- an operator wallet funded by small Tornado Cash withdrawals about 36 hours before the theft;
- multiple contract deployments and rehearsals before the final code reached a Binance hot wallet;
- pre-signed EIP-7702 authorisations prepared ahead of execution; and
- operational similarities with the Bybit and KelpDAO incidents previously linked to the same ecosystem.
Analytical attribution is not a legal verdict. “High confidence” describes the strength of TRM's intelligence assessment. It does not mean Binance, the FBI or another authority has completed a formal attribution.
How the theft unfolded
TRM traced transfers from Binance-attributed wallets across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. Assets worth about $6.36 billion at the time of transfer left mostly within a 20-minute window beginning around 20:05 UTC on October 29, 2026.
Ethereum: an EIP-7702 sweeper
On Ethereum, a pre-signed EIP-7702 authorisation allowed a Binance hot wallet to execute attacker-controlled sweeper code. The contract drained existing tokens and could continue sweeping assets that arrived later.
Other chains: normally signed transfers
On the other networks, the outflows appeared as ordinary signed transactions. TRM therefore assesses that Binance's hot-wallet signing infrastructure was compromised rather than ten independent blockchains failing simultaneously.
Binance says it has found no evidence that wallet private keys were leaked. Signed transactions and a private-key export are not the same thing: an attacker may abuse signing systems, permissions or internal infrastructure without extracting key material as a portable file.
Where the money is now
Freeze figures vary by reporting cut-off. Binance said roughly $3 billion had been frozen onchain. TRM separately identified about $2.67 billion in stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial, plus roughly $30 million in ETH and ARB frozen through Arbitrum, for about $2.7 billion at that stage.
Centralised stablecoin contracts can block listed addresses. Native BTC and ETH do not have a single issuer with equivalent authority. TRM estimated that the attacker still controlled more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion at the time, in addition to smaller holdings.
A freeze is not the same as a completed recovery. It means the affected tokens cannot continue moving while issuers, exchanges and investigators work through the legal and technical process.
Confirmed facts and open questions
| Issue | Current position |
|---|---|
| About $6.3–$6.36B left Binance wallets | Reported by Binance and blockchain analysts; final accounting may change |
| Ten networks were affected | Supported by public onchain analysis |
| A single employee laptop caused everything | Not established; Binance found additional breach points |
| Wallet private keys leaked | Binance says it has found no evidence |
| TraderTraitor was responsible | TRM assesses this with high confidence; no official Binance or government attribution yet |
| Customers will absorb the loss | Binance says SAFU and corporate funds will cover it |
What users should do
- Follow verified Binance notices and avoid compensation, claim or recovery links sent by direct message.
- Review login history, authorised devices, API keys and withdrawal records.
- If anything looks unusual, revoke sessions and credentials, then secure the account with a passkey or hardware security key where supported.
- Never provide a seed phrase, private key, OTP or recovery code to support staff or asset-recovery agents.
- Separate trading balances from long-term holdings and understand the different risks of exchange custody and self-custody.
FAQ
Has North Korea officially been blamed?
Not yet by Binance or a government agency as of October 31. TRM attributes the attack to TraderTraitor with high confidence, and ABC reported that Chainalysis agreed with that assessment.
Were Bitcoin and Ethereum themselves hacked?
The available evidence points to Binance hot wallets and signing infrastructure, not a compromise of the base networks.
Why can stablecoins be frozen while Bitcoin cannot?
Centralised stablecoin issuers retain contract-level controls that can block addresses. Bitcoin has no comparable issuer, although exchanges can reject deposits from flagged addresses.
Is $6.36 billion the final net loss?
No. It is a gross estimate based on assets moved at the time. Freezes, recoveries and market prices will affect the final figure.
References
- ABC News / Reuters
- TRM Labs investigation
- Binance Security Incident Update
- Binance Security Incident Update #2
- US government TraderTraitor advisory
Information current to October 31, 2026. The investigation and fund tracing remain active. Figures and attribution may change as verified findings are released. Educational information only; not financial or legal advice.
Share:
From Binance to Mt. Gox: seven of the biggest crypto hacks and what failed