Binance said on October 30, 2026, that it had reserved more than USD 6.3 billion to cover losses from the Binance crypto hack a day earlier. TRM Labs traced approximately USD 6.36 billion stolen across ten blockchains, most within about 20 minutes—the largest cryptocurrency theft it has recorded.
Key takeaways
Binance pledged company funds to cover every loss.
TRM attributes the theft to North Korea’s TraderTraitor with high confidence.
A malicious Ethereum delegation enabled repeated wallet sweeps.
Binance’s latest frozen-assets estimate reached around USD 3 billion.
Binance crypto hack drained wallets across ten chains
The theft began on October 29, 2026, at 20:05 UTC , with most outflows concentrated in roughly 20 minutes, TRM said. Its USD 6.36 billion valuation uses asset prices at the moment of each transfer and is about four times the USD 1.5 billion Bybit theft of February 2025.
Ethereum accounted for USD 3.79 billion, including 200,630 ETH and 185 other tokens. Among those tokens were 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD, while Bitcoin outflows totaled 18,270 BTC , equivalent to roughly USD 1.47 billion.
TRM traced approximately USD 628 million from Tron, USD 296 million from the XRP Ledger and USD 96 million from Solana. Arbitrum, Optimism and Base together lost about USD 39 million; Avalanche lost about USD 28 million and Polygon about USD 10 million. Another wave reached Avalanche and Polygon around 23:05 UTC.
Binance confirmed a security incident, suspended withdrawals on several networks and said user funds were safe. On October 30, it said USD 5 billion of its replacement reserves already matched the affected tokens, with purchases of the remainder underway. These reserves exclude frozen assets subject to recovery and verification.
How Ethereum authorizations enabled repeated thefts
The attacker used EIP-7702 delegations to make a Binance Ethereum hot wallet execute attacker-controlled code, according to TRM. This Ethereum feature lets an ordinary wallet authorize a smart contract to govern its behavior.
At 20:20 UTC, the operator submitted 50 pre-signed authorizations covering consecutive transaction counts. One matched the wallet’s current count, activating a sweeper contract that accepted only the operator’s instructions.
After an interval of three minutes and 24 seconds, one sweep moved 167,464 ETH along with 63 tokens, among them 1.615 billion USDT, and the delegation remained active, enabling six additional sweeps as further deposits came in. The compromised wallet also controlled a separate smart account containing 823 million USDC, which Circle subsequently froze.
Other chains used ordinary signed transfers. TRM’s assessment is that the attacker likely gained access to Binance’s hot wallet signing infrastructure across chains. Binance said its initial investigation suggested a compromised laptop, while further investigation identified additional breach points.
TRM links the attack to TraderTraitor
TRM attributes the Binance crypto hack to TraderTraitor , a North Korean state-sponsored hacking unit, with high confidence based on on-chain and off-chain intelligence. Chainalysis CEO Jonathan Levin separately assessed that TraderTraitor likely carried it out.
TRM traced preparations back at least 36 hours, including small Tornado Cash withdrawals, deployed attack code and rehearsals. It identified similarities with earlier North Korea-linked thefts. The FBI previously attributed the February 2025 Bybit attack to the same group.
Freezes blocked billions, but recovery is separate
TRM counted roughly USD 2.7 billion frozen by October 30 at 00:30 UTC; Binance later put the total at around USD 3 billion. TRM’s tally included USD 2.67 billion in stablecoins and about USD 30 million secured on Arbitrum.
Tether froze about 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD and World Liberty Financial 27.8 million USD1. Arbitrum’s Security Council removed 8,426 ETH and 74.6 million ARB from the attacker’s control.
The attacker sold about 325 million USDT through market makers and intent-based contracts for roughly 122,300 ETH. It also deposited 60 million USDT into Aave and borrowed about 19,760 ETH; Aave then froze affected markets.
TRM tracked more than 420,000 ETH and 18,270 BTC—approximately USD 2.4 billion beyond issuer freezing powers. Bitcoin was split through “peel chains” to complicate tracing.
TRM’s Ari Redbord explained that frozen funds require legal recovery proceedings. Chainalysis research head Eric Jardine said returns can take months or years.
Exchanges urged to check deposits and signing controls
TRM recommends screening deposits and counterparties against identified attacker addresses and monitoring treasury wallets for unexpected EIP-7702 delegations. It also advises rejecting unanticipated authorizations and separating signing infrastructure by chain and wallet tier.
Binance said on October 30 that it had begun recovering affected assets and was working with law enforcement and partners to trace, freeze and recover additional funds.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
