Binance said on October 30 that a security incident affected about $6.3 billion in assets, making it the largest cryptocurrency theft on record. The exchange traced the initial access to a compromised DevOps engineer’s laptop, while blockchain analysts attribute the attack to North Korea’s TraderTraitor group.
Binance Names a DevOps Laptop as the Likely Entry Point
Binance’s first finding is that the attacker used a compromised laptop belonging to a DevOps engineer to reach a service container, then submitted unauthorized withdrawal transactions. The exchange reported no evidence that a wallet private key leaked. Co-CEO Richard Teng said the breach was “not a single one-click action” and that Binance had found “additional points of breach.” He added that responsibility had not been attributed to anyone.
The theft surpasses the $1.5 billion Bybit heist from February 2025, the previous record. Nearly $3 billion of the affected assets has been frozen on-chain. Founder Changpeng Zhao wrote on X that it appeared to be a hack and that he no longer runs the exchange.
Conflicting Loss Figures From TRM Labs and Chainalysis
Estimates of the loss differ by source and by stage of the investigation. Early figures ranged from $3.3 billion to $5.8 billion. TRM Labs counts about $6.36 billion moved out across ten blockchains, while Chainalysis puts the value at about $5.912 billion at the time of the theft. One analysis cautioned that the early estimates should not be added together.
How the Attacker Moved Funds Across Ten Blockchains
TRM says most of the money left within roughly 20 minutes, starting at 20:05 UTC on October 29, with a second wave hours later. On Ethereum, the attacker used 50 pre-signed EIP-7702 authorizations so that one would match the hot wallet’s nonce. That route moved 167,464 ETH and about 1.6 billion USDT. Ethereum losses came to about $3.79 billion, and 18,270 BTC, worth about $1.5 billion, also left.
Nine other chains, including Bitcoin, Tron, Solana, Avalanche and the XRP Ledger, saw validly signed transfers. TRM reads that as a sign the attacker gained control of Binance’s signing system rather than exploiting a flaw on each chain separately.
Attacker Preparation Began at Least 36 Hours Earlier
According to TRM, the operator wallet was funded through small Tornado Cash withdrawals, and the attacker tested code on other wallets before the main run.
TRM Attributes the Theft to TraderTraitor With High Confidence
TRM attributes the attack to TraderTraitor, tracked as part of Lazarus Group and APT38, with high confidence. It cites traits shared with the Bybit heist and with the April 2026 KelpDAO hack. Chainalysis also names TraderTraitor as the likely culprit. Binance has not named an actor.
Laundering so far relies on large trades with market makers and lending platforms rather than cross-chain bridges, according to TRM.
Stablecoin Issuers and Arbitrum Freeze Funds
Several parties moved quickly to freeze assets. Tether froze more than 1.567 billion USDT, or 1.77 billion by a separate tally. Circle froze more than 800 million USDC, or 825 million by the same tally. The Arbitrum Security Council froze about $30.5 million. These freezes are part of the roughly $3 billion Binance describes as locked on-chain.
Binance Promises Reimbursement and a Withdrawal Restart
Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. Deposits are operating normally, but withdrawals are paused. The exchange says withdrawals will resume within 48 hours after a security revamp.
The company revoked authorizations for the affected address and is working with law enforcement and blockchain intelligence partners. It promised a technical post-mortem and an updated Proof of Reserves once remediation is complete.
Binance’s own account and the analysts’ tracing leave open questions about the “additional points of breach” Teng referenced. The exchange has not said what those points are, and the post-mortem is the first place the full intrusion path would be documented. Until then, the attribution rests on the on-chain behavior TRM and Chainalysis describe rather than on any statement from the exchange.
