An attacker drained approximately $6.3 billion from Binance hot wallets on October 29, 2026, starting around 20:05 UTC. The attack hit 10 blockchains and lasted under four hours, with most of the funds taken within 20 minutes. Binance froze about $3 billion on-chain with help from stablecoin issuers. Binance CEO Richard Teng pledged to cover all losses from the SAFU fund and company reserves. TRM Labs and Chainalysis attributed the attack with high confidence to TraderTraitor, North Korea’s state-sponsored hacking group. The attacker’s operator wallet was funded via Tornado Cash, and stolen funds have been commingled with proceeds from a separate Bitget hack via THORChain.
How It Started: One Laptop
Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop as the entry point. That laptop may have given the attacker access to a service container , an internal system that could submit withdrawal transactions , bypassing Binance’s normal signing controls without requiring access to any private key.
The attacker didn’t rush. According to TRM Labs, preparation started at least 36 hours before the first stolen transfer. The operator wallet received three small withdrawals from Tornado Cash , a cryptocurrency mixer that obscures where funds come from , on the morning of October 28. These funded the attacker’s on-chain infrastructure without creating a traceable link back to a known entity.
Binance later said its investigation found “additional points of breach” beyond the single laptop, but hasn’t published a full root-cause report yet.
How $2.5 Billion Left in a Single Transaction
The attack began on the XRP Ledger at 20:05 UTC, when 233 million XRP left five Binance wallets simultaneously. Then it moved to Ethereum.
At 20:20 UTC, the attacker submitted 50 pre-signed EIP-7702 authorizations to Binance’s main Ethereum hot wallet , Binance 14. EIP-7702 is a feature added in Ethereum’s Pectra upgrade that lets an ordinary wallet temporarily delegate control to a smart contract. The attacker had prepared all 50 authorizations in advance, then triggered them in a single burst.
Three minutes later, at 20:23 UTC, $2.53 billion left Binance 14 in one transaction ,to attacker-controlled addresses.
On the remaining nine chains, the attack used ordinary signed transfers rather than EIP-7702. The technical sophistication was chain-specific: the Ethereum mechanism was the most complex and produced the biggest single transaction.The total across all 10 chains , Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon came to roughly $6.3 billion.
Tornado Cash and the Underground Finance Layer
This is where the story connects to the dark web financial infrastructure we’ve tracked throughout 2026.
Tornado Cash, the service used to fund the attacker’s operator wallet, is a privacy tool built on Ethereum that has been the criminal crypto economy’s preferred obfuscation layer for years. It pools deposits from multiple users and returns equivalent amounts from the pool, breaking the blockchain’s transparent audit trail. US authorities sanctioned Tornado Cash in 2022 , but it continues to run as a decentralised smart contract that no individual controls.
On-chain investigator ZachXBT identified another connection: funds from the Binance hack were commingled at the same address as funds from a separate $388 million Bitget exploit, also attributed to North Korea , after both passed through THORChain, a cross-chain bridge that lets assets move between different blockchains without a central intermediar. This is the same layering strategy we covered when looking at how criminal proceeds move through the dark web’s crypto laundering infrastructure , mixers for initial obfuscation, cross-chain bridges for additional layering, all before final cash-out.
As of October 30, the hackers had not yet converted the stolen crypto to fiat. That process , converting billions in on-chain assets to usable money , is where North Korean hackers historically take the most time and face the most risk.
Who Is TraderTraitor?
TRM Labs attributed the attack to TraderTraitor with high confidence. The FBI had previously linked the same group to the Bybit hack. Chainalysis CEO Jonathan Levin separately assessed the same attribution. ZachXBT confirmed the fund-commingling with the Bitget hack, which was also a TraderTraitor operation.
TraderTraitor is North Korea’s most active cryptocurrency theft unit, operating as part of the Lazarus Group , a collection of state-sponsored hackers that generates foreign currency for the DPRK in defiance of international sanctions.
The group’s signature is visible in this attack: Tornado Cash funding of an operator wallet in the preparatory phase; off-chain pre-signing of authorizations executed in a rapid burst; targets selected for maximum single-transfer yield; immediate cross-chain movement to fragment funds. TRM noted the same pattern in the April 2026 KelpDAO hack.
This mirrors the broader state-sponsored cyber threat landscape we’ve covered this year , the same North Korean hackers that Google’s Threat Intelligence Group flagged in connection with LLM-jacking attacks against AI platform infrastructure have now pulled off the largest single cryptocurrency theft in recorded history.
What Was Frozen and How
Three stablecoin issuers responded almost immediately. Within about an hour of the attack beginning:
- Tether froze 971.1 million USDT in the attacker’s main receiving wallet
- Circle froze 823 million USDC in the same wallet
- World Liberty Financial froze 27.8 million USD1
These freezes alone represent nearly $1.8 billion of the stolen total. Combined with other on-chain freezes coordinated by Binance and its partners, approximately $3 billion was frozen before the attacker could move it further.
The remaining approximately $3.3 billion in non-stablecoin assets , primarily Bitcoin, ETH, XRP, and SOL , was still in the attacker’s wallets as of the latest public reporting, unconverted.
What Binance Is Doing for Users
CEO Richard Teng was direct: Binance will cover all user losses. The exchange said it has set aside more than $6.34 billion in company funds to back that commitment , which includes approximately $5 billion in affected tokens Binance already holds, around $1.2 billion in its SAFU emergency insurance fund, and additional reserves.
Binance suspended deposits and withdrawals during the investigation. It has revoked the affected signing permissions and is working with law enforcement.
One additional context point: this hack lands while the US Department of Justice is reviewing Binance’s compliance with its 2023 guilty plea and $4.3 billion settlement for sanctions violations. That review now unfolds alongside the criminal investigation into the theft itself.
What Binance Users Should Do Right Now
Binance’s commitment to cover losses means user balances should not be at risk , but the investigative picture is still incomplete. Binance identified “additional points of breach” on October 30, meaning the full scope of what was accessible is still being determined.
For users, the immediate practical steps are similar to any major exchange security event.
If you have funds on Binance, monitor official communications from Binance’s verified channels only. Scammers will be sending phishing emails and messages claiming to be Binance support, asking you to “verify your account” or “claim your reimbursement.” That contact is fake. Go directly to Binance.com — do not follow any links in emails or messages.
If you have withdrawal concerns, wait for official guidance from Binance rather than acting on third-party instructions. The SAFU and company-fund commitment means user balances are covered under the terms Binance has stated.
For anyone whose cryptocurrency account details may have been in prior breaches , including the August 2026 SafePal data leak that exposed 40,000 buyers’ personal information , this is a reminder that dark web data exposure creates specific follow-on targeting risks even when your exchange account itself isn’t directly compromised.
Frequently Asked Questions
How much was stolen from Binance?
Approximately $6.3 billion, across 10 blockchains. It is the largest crypto theft on record , about four times the $1.5 billion Bybit hack in February 2025.
When did the Binance hack happen?
October 29, 2026, starting at around 20:05 UTC. Most of the funds were drained within 20 minutes. The attack continued across multiple chains until approximately midnight UTC.
Who is behind the Binance hack?
TRM Labs and Chainalysis attribute the attack with high confidence to TraderTraitor, North Korea’s state-sponsored cryptocurrency theft unit, which is part of the Lazarus Group. The same group was behind the $1.5 billion Bybit hack and the $388 million Bitget exploit.
How did the attack work?
A compromised DevOps engineer’s laptop gave the attacker access to Binance’s internal withdrawal signing infrastructure. On Ethereum, the attacker used EIP-7702 to convert Binance’s hot wallet into an attacker-controlled contract, then swept $2.53 billion in a single transaction. On other chains, signed transfers were used.
How was Tornado Cash involved?
The attacker’s operator wallet was funded via small withdrawals from Tornado Cash , a decentralised cryptocurrency mixer — 36 hours before the attack, obscuring the funding trail.
Will Binance cover user losses?
Yes. Binance CEO Richard Teng confirmed Binance will cover all user losses from the SAFU fund and company reserves. The exchange has set aside over $6.34 billion for this purpose.
How much of the stolen crypto has been frozen?
Approximately $3 billion, primarily through stablecoin issuer freezes by Tether (971M USDT) and Circle (823M USDC), plus additional on-chain freezes. About $3.3 billion in non-stablecoin assets remains unfrozen as of October 30.
Should I move my funds off Binance?
Binance has suspended deposits and withdrawals while investigating. Until the exchange re-enables normal operations, the decision is limited to what’s currently possible. Monitor Binance’s official channels for updates.