Inside the $6.3 Billion Binance Heist: How North Korea's TraderTraitor Drained the World's Largest Exchange

Key points

The FBI, with the Secret Service and IRS-CI, attributed the theft of more than $6 billion from Binance on or about October 29, 2026 to North Korea's TraderTraitor, which also hit Bybit for about $1.5 billion in 2025 ¹ ¹⁸.
Most funds left Binance hot wallets across 10 blockchains in about 20 minutes; roughly $2.85 billion has been frozen on-chain, while Elliptic says about $3.33 billion sits in wallets no issuer can freeze ¹ ³ ⁹.
Binance first blamed a compromised DevOps engineer's laptop, then said there were additional points of breach, and it reserved over $6.34 billion in company funds to cover losses ² ¹⁰.
Withdrawals reopened in phases on Sunday, November 1, with Binance reporting about 95% of the affected assets replaced and a net outflow of $3.6 billion, or 2.1% of assets under management ⁶ ¹⁷.

A 20-Minute Raid on Hot Wallets

The theft began around 4:05 p.m. Eastern on Thursday, October 29, when attackers started draining Binance’s internet-connected hot wallets, the ones used to process everyday withdrawals. Blockchain intelligence firm TRM Labs put the haul at about $6.36 billion across ten blockchains, most of it moved in roughly 20 minutes. Elliptic’s estimate is $6.43 billion, while Binance itself says about $6.3 billion ¹ ⁷ ²⁵.

The scale is hard to overstate. The theft is about four times the $1.46 billion taken from Bybit in February 2025, and Elliptic says it nearly doubles everything North Korea-linked actors had stolen in crypto to date ¹ ¹⁰. The loot spanned Ethereum, Bitcoin, Tron, XRP Ledger, Solana and others, with Ethereum the hardest hit at roughly $3.8 billion ²².

The preparation was patient. TRM says work began at least 36 hours earlier, with small Tornado Cash withdrawals funding an operator wallet and test runs on other wallets before the code reached a Binance hot wallet ⁹. Binance said it expects to publish a fuller incident report once its investigation is complete ⁶.

Image from blogger.googleusercontent.com — Image: blogger.googleusercontent.com

How the Attackers Got In

Binance’s first explanation pointed to a compromised DevOps engineer’s laptop that gave an attacker access to a service container, where unauthorized withdrawals were submitted. It said it found no evidence of a private key leak ³ ⁸. Co-CEO Richard Teng later stressed this was not a one-click action and that investigators had found additional points of breach ¹⁰. He also said the attackers used a self-destruct mechanism to wipe tooling and traces, and that the hot wallet delegation bypassed normal approval controls ²³.

On Ethereum, TRM and others describe a clever use of EIP-7702, an upgrade that lets ordinary wallets temporarily run smart-contract code. The attacker submitted 50 pre-signed authorizations covering consecutive transaction counts, guaranteeing one would match a busy hot wallet, then swept 167,464 ETH and 63 tokens, including 1.615 billion USDT, in one transaction ³ ¹⁵. The upgrade itself was not broken; the likelier explanation, per TRM, is that Binance’s signing infrastructure was compromised ³ ²⁰. Elliptic put it plainly: the attacker appears to have gotten Binance’s own systems to sign on their behalf, much like the Bybit theft, where people and infrastructure around the wallets were compromised, not the cryptography ³.

Security vendors drew a broader lesson. Experts quoted by Trending Topics argued that developer machines are now among the most privileged devices in any firm and that signing and approval should be separated and policy-checked independently. The article itself notes that most of those voices work for companies selling security or custody products ²⁴.

Image from ranker.salhi.com — Image: ranker.salhi.com

Attribution to North Korea

TRM Labs and Chainalysis attributed the attack to TraderTraitor within hours, and Elliptic saw strong overlaps. The strongest link: funds stolen from Binance commingled with proceeds of last month’s Bitget exploit, which had already been tied to North Korean actors ⁹ ³. Other hallmarks included Tornado Cash funding, rehearsals and pre-signed transactions executed in a burst, as in the Bybit and KelpDAO thefts ³.

The FBI made it official on Saturday, with the Secret Service and IRS-CI, saying it saw TraderTraitor converting stolen assets mainly into Ethereum ahead of further laundering through DeFi and instant swap services. It published wallet addresses and urged infrastructure and service providers to block transactions tied to them ¹ ¹⁸. The Verge noted the statement offered few other details or evidence ⁵. Separately, President Trump said the day before that North Korea’s involvement was not certain ¹⁴ ¹⁹.

Some caution was voiced early. Elliptic noted deviations from usual North Korean laundering, such as holding stolen USDT for 37 minutes on Ethereum and leaning on market makers and DeFi lending rather than bridges. Chainalysis reported laundering patterns it had never seen, with thousands of automated transactions ³.

TraderTraitor’s wider tradecraft is well documented. Reports cited by The Hacker News describe trojanized Terraform providers and job-themed lures from front companies, boosted by AI-generated personas ¹. In a related development, Kaspersky reported that the broader Lazarus ecosystem was using AI-built fake résumé sites and post-quantum ML-KEM-1024 encryption in a South Korea campaign called Operation FlashHole. That is a separate operation, but it shows the same state-backed sophistication ⁴ ¹². The Treasury also sanctioned Russian nationals on October 28 for laundering crypto for North Korean IT worker schemes, another distinct strand of the same revenue machine ²⁶.

Image from techcrunch.com — Image: techcrunch.com

Frozen, Replaced and Still Missing

Centralized stablecoin issuers moved fast. Tether froze more than $1.5 billion in USDT and Circle more than $800 million in USDC, with Ripple, World Liberty Financial and Arbitrum’s Security Council adding more ³ ⁸. Elliptic counts about $2.84 billion frozen, but says the attacker controls around $3.33 billion in assets no issuer can freeze, including 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX across about 43 wallets ³. Elliptic’s Tom Robinson does not expect the frozen share to rise much ⁹. CoinDesk framed this as a paradox: centralization made the theft possible, yet issuer controls saved billions ²¹. Some on the industry side asked whether smaller victims would get such rapid help ¹⁶.

For customers, Binance moved to make everyone whole. It set aside more than $6.34 billion in company funds, about $5 billion already in the affected tokens, drawing on its SAFU emergency fund, futures insurance fund and corporate treasury, and plans to restore SAFU to about $1 billion ¹⁰ ¹⁸. A CoinDesk review found that some drained wallets had appeared in earlier proof-of-reserves materials, raising questions about reserve backing ¹⁹ ²³.

Withdrawals restarted in phases on Sunday, November 1. Binance said it had covered about 95% of the impacted amount, with the remaining 5% in less liquid tokens that take longer to source ¹⁷ ⁶. It processed $4.6 billion in withdrawals against $1.0 billion in deposits, a net outflow of $3.6 billion, or 2.1% of assets under management ⁶. A zero-knowledge proof of reserves is expected by November 3 ¹⁸.

Image from coindesk.com — Image: coindesk.com

Markets, Regulation and What Comes Next

Markets stayed composed. Bitcoin fell roughly 3% to 7% depending on the measure, and more than $1.3 billion in leveraged positions were liquidated, far milder than past exchange shocks ¹¹ ²⁰. Analysts at Cantor Fitzgerald, TD Cowen and Compass Point urged buying crypto stocks on weakness, saying the attack hit Binance’s security rather than the underlying technology, though they flagged possible pressure on stablecoin supply and DeFi lending ²⁷.

The policy debate is heating up. NPR’s explainer noted that exchanges hold customer assets without the broker regulation and insurance found in traditional markets, so Binance’s pledge to repay is not a legal obligation ⁷. CFTC Chairman Michael Selig said the breach proves the point behind proposed crypto-market rules, and regulators in Abu Dhabi and Thailand said they were monitoring the situation ²⁰ ¹³.

Open questions remain: the full root cause, how much of the roughly $3.3 billion unfreezable remainder can be intercepted as it hits exchanges, and whether users keep their confidence in Binance. The founder, Changpeng Zhao, struck a defiant note: it hurts, but they survive ²⁰.

Primary sources

FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist (thehackernews.com) – The Hacker News reports the FBI's formal attribution to TraderTraitor, also tracked under several aliases, together with the Secret Service and IRS-CI. The agencies saw the actor converting stolen assets mostly to Ethereum ahead of further laundering through DeFi and instant swap services, and published wallet addresses. It notes Binance resumed phase one of withdrawals, the $6.43 billion figure surpassing Bybit's $1.46 billion, funds stolen across 11 blockchains, and $2.85 billion frozen by Tether, Circle, Ripple, Arbitrum and Optimism. It also summarizes Elliptic's comments and recent SentinelOne, Zscaler and Microsoft findings on TraderTraitor's trojanized Terraform providers, FLATROOF and ROOFDECK malware, and AI-assisted recruiter lures. Published by thehackernews.com.

Further sources

Binance links $6.3 billion crypto theft to compromised DevOps laptop (bleepingcomputer.com) – BleepingComputer's piece on Binance linking the roughly $6.3 billion theft to a compromised DevOps engineer's laptop. Only a short excerpt was available, so it is used just for that point. Published by bleepingcomputer.com.
Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen (thehackernews.com) – The Hacker News's detailed early account of the incident. Binance said about $6.3 billion was affected and nearly $3 billion frozen, pointing to a compromised DevOps laptop and no private key leak, and promised to cover losses via SAFU. It lays out TRM Labs' technical reconstruction (50 pre-signed authorizations, one matching, 167,464 ETH and 63 tokens moved), Chainalysis and Elliptic's attributions with the shared Ethereum address and Tornado Cash funding, and Elliptic's cautions about slower, market-maker-based laundering. It also gives figures on frozen funds and the roughly $3.33 billion the attacker still controls. Published by thehackernews.com.
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption (thehackernews.com) – The Hacker News on Kaspersky's analysis of Lazarus's Operation FlashHole, a separate espionage campaign against at least three South Korean firms since July 2025. It abuses INISAFE CrossWeb EX, uses GitHub-hosted fake résumé sites, and deploys a layered toolset (TechHub, TouchHub, ClientHub, LPEClient, Cubridge) with ML-KEM-1024 post-quantum encryption. Used here as related context on Lazarus tradecraft, not part of the Binance incident. Published by thehackernews.com.
North Korea linked to massive Binance crypto heist (theverge.com) – The Verge's short report on the FBI statement attributing the theft to North Korea's TraderTraitor and noting stolen assets being converted to Ethereum. It points out the agency offered few other details or evidence, and that Binance reopened withdrawals. Published by theverge.com.
Binance resumes withdrawals following $6.3 billion breach (techcrunch.com) – TechCrunch on Binance's phased reopening of withdrawals on Sunday. Binance said it had covered 95% of stolen assets, would bear the loss rather than users, and would publish a fuller incident report. Between 6am and 3:30pm UTC it processed $4.6 billion in withdrawals and $1.0 billion in deposits, a net outflow of $3.6 billion or 2.1% of assets under management. Published by techcrunch.com.
A simple explainer of the massive $6.3 billion crypto heist at Binance (npr.org) – NPR's explainer covering what crypto exchanges are, the timeline of the hack (about 20 minutes starting 4:05 p.m. ET Thursday), why experts pointed to TraderTraitor, and the regulatory critique. It quotes TRM's Ari Redbord and Better Markets' Amanda Fischer on weaker rules for exchanges and why Binance's repayment promise is not necessarily binding. Published by npr.org.
Binance flags 'potential security issue,' says approximately $6.3 billion impacted (npr.org) – NPR's early report on Binance flagging a potential security issue with about $6.3 billion affected. It carries Binance's laptop explanation, the Tether and Circle freezes, a 3.2% bitcoin drop, and background on founder Changpeng Zhao, his 2023 guilty plea and 2025 pardon. Zhao said it looked like a hack and expected users to be covered. Published by npr.org.
The $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes (wired.com) – WIRED's reporting on the 20-minute theft, with TRM's account of 36 hours of preparation, wallet tests and rehearsals. Elliptic's Tom Robinson says the attack would nearly double North Korea's crypto thefts to date, and that about $2.8 billion (44%) is frozen with the remaining $3.3 billion mostly unfreezable. Includes Chainalysis's commingling evidence and Sophos's Rafe Pilling on TraderTraitor. Published by wired.com.
Binance hackers stole $6.3 billion in record-breaking crypto heist (theverge.com) – The Verge on Binance's disclosure of the $6.3 billion theft, its pledge to cover losses, the roughly $1.3 billion emergency fund, and over $6.34 billion of company funds reserved, $5 billion in the impacted tokens. Teng said the attack was complex and involved more than one engineer's permissions. Notes TRM and Chainalysis attribution, the 2019 breach, and that this is about four times the Bybit record. Published by theverge.com.
Binance hit by 'largest crypto theft on record' as North Korean hackers steal $6.3bn in just 20 minutes (techradar.com) – TechRadar on the 20-minute theft, TRM's TraderTraitor attribution, the spread across 10 chains with Ethereum worst hit at about $3.79 billion, and Teng's remark that this was no one-click action. It compares market reaction to the Mt. Gox and Bybit incidents and relays NordVPN's phishing warnings. Published by techradar.com.
Security experts warn North Korean hackers aren't just using AI in their new campaigns, but also 'post-quantum' encryption (techradar.com) – TechRadar on Kaspersky's Operation FlashHole findings: a Lazarus campaign since at least July 2025 against South Korean software, construction and communications equipment firms, using AI-looking résumé sites and CrossWeb EX. An updated LPEClient uses ML-KEM-1024 post-quantum key exchange to protect payload delivery, but this does not hide the malware on endpoints. Used as related context on Lazarus capabilities. Published by techradar.com.
Binance estimates $6.3 billion impact from crypto hack as withdrawals remain suspended (mlq.ai) – MLQ.ai's summary of early facts: roughly $3 billion frozen, withdrawals paused, SAFU and company funds promised, and attribution to TraderTraitor still an investigative assessment. It notes regulators in Abu Dhabi and Thailand were monitoring, and that CoinDesk found hot wallets in Binance's October proof-of-reserves materials. Published by mlq.ai.
Binance opens transactions after historic crypto heist ‘north’ of six billion dollars (digitaltrends.com) – Digital Trends on Binance's phased reopening, starting with 15 cryptocurrencies, and the roughly 95% replacement of stolen assets from SAFU, the Futures Insurance Fund and treasury. Notes more than $3.5 billion in net outflows per DefiLlama, the FBI attribution, and Trump saying North Korea's involvement was not certain. Published by digitaltrends.com.
How Hackers Stole $6.3 Billion From Binance in Minutes (gizmodo.com) – Gizmodo's technical explainer on the EIP-7702 mechanism, with Blockaid's reconstruction of 50 authorizations and one landing on the hot wallet's live nonce, plus a point that the upgrade did not let a stranger take over any wallet. It also covers attribution to TraderTraitor, ZachXBT's THORChain commingling evidence, and deposit-sweep issues noted by Conor Grogan. Published by gizmodo.com.
Binance Reassures Users That $6.3 Billion in Stolen Crypto Is, Like, Pocket Money to Them (gizmodo.com) – Gizmodo's piece on Binance reassuring users, with Reuters-sourced comments on a negligible share of total assets, Trump's response, muted market fallout, and CoinDesk-reported criticism that stablecoin freezes came faster for Binance than for smaller victims. Published by gizmodo.com.
Binance opens crypto withdrawals in phases starting with bitcoin following $6.3 billion hack (coindesk.com) – CoinDesk on the phased withdrawal reopening on Sunday starting with bitcoin and assets on 15 other blockchains. Binance said about 95% of affected assets were replaced, up from 90%, that top tokens are fully backed, and that about $3 billion is frozen. Includes the promise that losses will not pass to users and the planned proof-of-reserves report. Published by coindesk.com.
FBI says North Korea stole more than $6bn in the Binance hack (thenextweb.com) – The Next Web on the FBI attribution, including the call for private firms to block transactions with listed addresses (hundreds of Ethereum, 19 Bitcoin, one Solana). It covers Elliptic's $6.43 billion figure, the earlier Bybit attribution, Trump's remarks, Binance's 95% coverage and plan to refill SAFU to about $1 billion, and the zero-knowledge proof of reserves expected by November 3. Published by thenextweb.com.
Binance says it has replaced 90% of stolen crypto after massive $6.3 billion breach (coindesk.com) – CoinDesk on Binance saying it replaced 90% of stolen crypto, funded by corporate treasury, futures insurance fund and a partial SAFU deployment. Notes the remaining 10% is less liquid tokens, Teng's additional breach points, Trump saying we don't know about North Korea, and a CoinDesk finding that drained wallets appeared in earlier reserve disclosures. Published by coindesk.com.
Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History (decrypt.co) – Decrypt's comprehensive explainer: the timeline, the EIP-7702 detail, Teng saying the delegation did not pass normal approvals, the Tether and Circle freezes, and the roughly $3.3 billion attacker holdings per Elliptic. It covers the law enforcement response, a relatively calm market, CFTC Chairman Selig's regulatory argument, and Zhao's Musk spat and defiant statement. Published by decrypt.co.
The $6.3 billion Binance hack paradox: Centralization made the hack possible, but also saved $3 billion (coindesk.com) – CoinDesk analysis arguing that centralization both enabled the hack, through a single point of failure, and saved about $3 billion via issuer freezes of USDT and USDC. It contrasts this with Bitcoin and Ether, which lack freeze mechanisms, and notes that freezing does not automatically return funds to victims. Published by coindesk.com.
Binance Loses $6.3 Billion in the Biggest Crypto Hack in History (Update) (trendingtopics.eu) – Trending Topics breakdown of what was stolen per TRM (about $3.8 billion on Ethereum, 18,270 BTC, about $630 million on Tron, about $300 million in XRP), how it was first spotted on-chain, and early laundering via Uniswap and Aave. It covers the freeze totals, Binance's coverage promises, the SAFU fund of about $1 billion, and Binance's roughly $144 billion in assets before the hack. Published by trendingtopics.eu.
Binance uncovers wider breach in $6.3 billion exploit, targets Sunday withdrawal restart (coindesk.com) – CoinDesk on Teng's video statement: additional breach points, a self-destruct mechanism erasing evidence, and EIP-7702 delegation bypassing normal approvals. Teng targeted a Sunday restart of withdrawals and said Binance was reviewing cloud systems, employee devices, key management and signing procedures. A CoinDesk reserve-data check found compromised wallets were previously listed as backing customer balances. Published by coindesk.com.
Binance Super Hack Offers a Preview of Attacks in the A.I. Era (trendingtopics.eu) – Trending Topics collecting assessments from Check Point, AMLBot, EXANTE, Teroxx and The Vault, which agree the weak spot was a privileged human endpoint. They discuss AI-enabled social engineering, automated laundering, independent transaction policy enforcement, tighter custody control and advice for retail users. The article notes that most quoted experts work for firms selling security or custody products. Published by trendingtopics.eu.
Binance loses $6.3 billion in largest crypto heist ever (techspot.com) – TechSpot's summary: TRM puts the haul at about $6.36 billion from ten blockchains, Binance froze roughly $3 billion and expects to cover losses, and investigators found additional breach points beyond the laptop. It adds Elliptic's reasoning on Tornado Cash funding and rehearsal, the comparison with Bybit's cold-wallet theft, and Binance's smaller 2019 hot wallet theft of about $40.7 million. Published by techspot.com.
U.S. sanctions Russian nationals for laundering millions in crypto for North Korean IT workers (coindesk.com) – CoinDesk on the OFAC sanctions announced on October 28 against 10 individuals and one entity tied to North Korean IT worker schemes, including Russian nationals Ilya Boykov and Vitold Obertas who allegedly converted crypto for North Korea. It also covers a North Korean-run center in Russia and listed crypto addresses. This is a separate, related development about North Korean revenue generation. Published by coindesk.com.
Wall Street analysts urge investors to buy crypto stocks after $6.3 billion Binance hack (coindesk.com) – CoinDesk on research notes from Cantor Fitzgerald, TD Cowen and Compass Point arguing the hack is unlikely to derail the crypto market. They cite issuer freezes, say the attack hit Binance's security rather than Bitcoin's technology, note Binance's liquidity to cover losses, and warn of stablecoin and DeFi lending pressure and possible share gains for Coinbase and Bullish. Published by coindesk.com.