Binance Hack Linked to North Korea’s TraderTraitor After $6.3B Theft

Binance, the world's largest cryptocurrency exchange, is investigating a hack that drained roughly $6.3 billion in digital assets on October 29, 2026, an incident blockchain investigators have linked to TraderTraitor, a North Korean state-sponsored hacking operation. The exchange said early findings point to a compromised laptop belonging to a DevOps engineer, and it has frozen about $3 billion in affected assets while promising customers they will not bear the losses.

The Binance hack matters beyond its size. At about $6.36 billion, TRM Labs called it "the largest crypto theft on record," roughly four times the $1.5 billion Bybit hack of February 2025, and it lands at a moment when confidence in the industry was already fragile. The attribution to a unit tied to Pyongyang also raises the stakes, since US authorities have said such thefts fund North Korea's weapons programs.

TraderTraitor attribution

TRM Labs attributed the Binance hack to TraderTraitor with high confidence, citing what it described as robust onchain and offchain intelligence. "TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence," the firm said. Chainalysis co-founder and CEO Jonathan Levin reached the same conclusion, putting the haul slightly higher at $6.4 billion and pointing to links with earlier attacks.

Independent onchain investigator ZachXBT said funds stolen from Binance and from an earlier Bitget exploit were commingled at the same address after moving through THORChain. "This indicates the same actor is likely behind both incidents," he said, noting the Bitget attack had already been attributed to TraderTraitor. Binance itself has not officially confirmed the attackers' identities.

TraderTraitor began as a US government codename for a cluster of North Korean state-sponsored cyber activity and was named in an April 2022 joint advisory from the FBI, CISA and the US Treasury warning that the group was targeting crypto exchanges and DeFi protocols. Security firms track it under names including Jade Sleet, UNC4899 and Slow Pisces, and it is widely described as a subunit of the Lazarus Group. The FBI says the group targets company employees through social engineering, and US authorities have linked it to the Bybit theft and to the May 2024 theft of more than $300 million from DMM Bitcoin.

TRM said several features of the Binance hack match earlier North Korea-linked heists, including the Bybit hack and the April 2026 KelpDAO hack: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. Blockaid CEO Ido Ben-Natan had earlier told Cointelegraph that the attack's sophistication and onchain preparations resembled North Korean activity. North Korea has previously denied hacking crypto exchanges, Axios noted.

How the Binance hack unfolded

The outflows began on the evening of October 29, when billions of dollars in crypto started leaving Binance wallets. TRM traced every transfer from Binance-attributed wallets to attacker-controlled addresses across ten blockchains, including Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon, with most of the activity occurring within about 20 minutes starting at 20:05 UTC.

On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorizations prepared in advance. Three minutes and 24 seconds after the delegation, the operator instructed the wallet to send its entire balance to an attacker-controlled address, and it kept sweeping newly arriving funds at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC. Between 20:05 and 20:09 UTC, five Binance wallets on the XRP Ledger sent 233.46 million XRP to a single attacker address, and at 20:20 UTC a Binance Bitcoin hot wallet sent 18,270 BTC to the attacker.

In TRM's assessment, the pattern points to a compromise of Binance's hot wallet signing infrastructure, giving the attacker the ability to make the exchange's signing system approve transactions of its choosing across chains. That fits Binance's own account: the exchange said investigators found no evidence of leaked wallet private keys, because access to the internal withdrawal system was enough to push transfers out. Binance has yet to publish a root cause.

Binance founder Changpeng Zhao acknowledged the incident on X, writing, It does look like a hack on Binance. Zhao, who stepped down as CEO in 2023, said that as a shareholder he expected all affected users to be fully compensated. The outflows were first spotted Thursday evening, when about $2.8 billion was reported leaving Binance wallets before the full scale became clear.

Freezes and the race to recover funds

Binance and its blockchain partners have frozen approximately $3 billion in affected assets. The exchange said at 23:35 UTC on October 29 that the verified total frozen had reached $2.54 billion, and it temporarily suspended deposits and withdrawals, revoked affected address authorizations and contacted law enforcement.

Stablecoin issuers moved quickly. Tether CEO Paolo Ardoino said in an X post that the company froze more than $1.5 billion of its stablecoin "related to a potential Binance exchange hack," and Circle Internet Group's Jeremy Allaire said $800 million of its coin had been frozen amid reports of a potential exploit. Binance co-CEO Yi He said Ripple helped stop about $200 million from moving, and World Liberty Financial froze the 27.8 million USD1 in the main receiving wallet.

The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave, and still controls more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, plus smaller amounts on other chains. Based on previous large thefts, TRM expects the next stage of laundering to involve cross-chain bridges, swap services and over-the-counter brokers. A Pangolin Intelligence analyst told CNN that "the cat and mouse game has barely begun," expecting North Korea to tap money-laundering networks to cash out.

Market fallout and what Binance owes users

The Binance hack weighed on a market that had been riding a two-month price rebound. "The rumoured Binance hack is definitely driving down coin prices," said Fredrick Collins, chief executive and co-founder of crypto data platform Velo Data, adding that Binance is so central to the industry that any hit to confidence in it is a hit to confidence in the whole sector.

Binance assured customers their funds remained safe and pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and company resources. The SAFU fund was established in 2018 as a backstop for customers in extreme situations and is generally maintained at around $1 billion, though it has fluctuated with market movements, Binance said in 2024.

The theft came on the same day event-contract venue Polymarket halted trading on its international exchange for an hour after saying a third-party software provider was compromised. Two days before the Binance theft, on October 27, the exchange said it had blocked a week of North Korea-linked attacks from a campaign known as Contagious Interview, which uses fake job interviews to trick developers into running malicious code; Binance has not said whether the compromised engineer's laptop is connected to that campaign.

Conclusion

The Binance hack is the largest cryptocurrency theft on record at roughly $6.36 billion, and three separate investigators, TRM Labs, Chainalysis and ZachXBT, have linked it to North Korea's TraderTraitor unit with high confidence, though Binance has not confirmed the attribution. About $3 billion has been frozen, but the attacker still holds an estimated $2.4 billion in ETH and BTC.

The next concrete steps are Binance's updated Proof of Reserves and a comprehensive technical post-mortem, which the exchange has said it will release once its findings are verified. Investigators, meanwhile, are watching for the stolen funds to move through bridges, swap services and over-the-counter brokers.

Frequently Asked Questions

How much was stolen in the Binance hack on October 29, 2026?

TRM Labs traced approximately $6.36 billion moving out of Binance wallets across ten blockchains, most of it within about 20 minutes starting at 20:05 UTC. Binance has put the impact at about $6.3 billion, while Chainalysis CEO Jonathan Levin estimated $6.4 billion. It is the largest crypto theft on record, roughly four times the $1.5 billion Bybit hack.

Who is TraderTraitor, the group linked to the Binance hack?

TraderTraitor is a North Korean state-sponsored hacking operation, originally a US government codename used in an April 2022 joint advisory from the FBI, CISA and the US Treasury. Security firms track it as Jade Sleet, UNC4899 and Slow Pisces, and it is widely described as a subunit of the Lazarus Group. US authorities have linked it to the Bybit and DMM Bitcoin thefts.

Will Binance users get their money back after the $6.3 billion hack?

Binance said user funds are safe and pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and company resources. Founder Changpeng Zhao, who stepped down as CEO in 2023, said that as a shareholder he expected all affected users to be fully compensated. The SAFU fund, set up in 2018, is generally maintained at around $1 billion.

How did attackers pull off the Binance hack without private keys?

Binance's preliminary investigation points to a compromised laptop belonging to a DevOps engineer, and the exchange said it found no evidence of leaked wallet private keys. TRM Labs assesses the attacker gained the ability to make Binance's hot wallet signing infrastructure approve transactions of its choosing across ten blockchains, including an EIP-7702 delegation that turned an Ethereum hot wallet into an attacker-controlled sweeper.

How much of the stolen Binance funds has been frozen?

Binance and its blockchain partners have frozen approximately $3 billion in affected assets. Tether froze more than $1.5 billion of its stablecoin and Circle froze $800 million, while Ripple and World Liberty Financial also blocked funds. The attacker still controls more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion.