Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
Through blockchain intelligence, TRM Labs confirmed that North Korean hackers were responsible for the breach, linking it to previous state-sponsored crypto heists. The evidence revealed clear overlaps between the wallets used in this operation and those associated with past North Korean thefts.
TRM, in a post on its website Thursday, attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," the firm said.
“Early on October 29, the operator deployed a first piece of code for the attack and tested it on two wallets,” TRM says. “Later that day, it rehearsed the final version on a third wallet, then routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.”
Between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP to a single attacker address, leaving each wallet with only its minimum balance.
At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address, which began splitting the funds into round 1,000 BTC and 100 BTC pieces inside the same block.
At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweeper contract that accepts instructions only from the operator.
Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep. Later sweeps landed in the frozen wallet, which now holds 1.175 billion USDT.
World Liberty Financial froze the 27.8 million USD1 in the main receiving wallet at 22:10 UTC, and froze USD1 in the compromised Binance hot wallet at 22:26 UTC.
At 00:08 UTC, it used those powers to force two transfers out of the attacker's wallet on Arbitrum, moving 8,426 ETH and 74.6 million ARB, about USD 30 million, out of the attacker's reach.
On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC.
TRM traced every transfer from Binance-attributed wallets to attacker-controlled addresses across ten blockchains. Valuing each transfer at the price of the asset at the moment it was taken, the total is approximately USD 6.36 billion. At current prices, the same assets are worth about USD 6.23 billion.
Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion.
Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. We base this assessment on robust on and off-chain intelligence sources.
Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.
Early indicators on the Ethereum activity suggested the attacker had phished the authorizations. That explanation covers Ethereum and leaves the other chains unexplained.
Experts, such as TRM Labs, quickly attributed the extraordinary $6.3bn Binance cryptocurrency theft to TraderTraitor, an elite North Korean hacking unit that has also been known as the Lazarus Group.