Key Takeaways

On October 29, 2026, an attacker transferred approximately $6.36 billion from Binance’s wallets across ten blockchains, with the majority executed within a ~20-minute window starting at UTC 20:05. This makes it the largest recorded cryptocurrency theft in history—four times the scale of the $1.5 billion Bybit breach in February 2025. Binance has confirmed a security incident and suspended withdrawals across multiple networks.

TRM attributes this attack to North Korea’s elite hacking unit, TraderTraitor, based on reliable on-chain and off-chain intelligence. We hold high confidence in this attribution. TRM is actively tracking these funds and issuing alerts to partners via the Beacon Network.

On Ethereum, the attacker exploited an EIP-7702 delegation to transform a Binance hot wallet into a “sweeper” under their control, pre-positioning 50 pre-signed authorizations. Within the same time window, Binance wallets on the other nine chains were compromised through standard signed transactions, transferring funds directly to the attacker. TRM assesses this points to a breach of Binance’s hot wallet signing infrastructure.

Tether, Circle, Ripple, and World Liberty Financial have frozen approximately $2.67 billion in stablecoins. The Arbitrum Security Council has frozen 8,426 ETH and 74.6 million ARB on its network, totaling roughly $2.7 billion in frozen assets. The attacker raced against these freezes—selling USDT to market makers and borrowing ETH on Aave using USDT as collateral. Currently, over 420,000 ETH and 18,270 BTC are held in assets beyond reach of any issuer, valued at approximately $2.4 billion.

Timeline of Events

During the evening of October 29, wallets belonging to Binance—the world’s largest crypto exchange—began flowing tens of billions in digital assets. Within minutes, wallets across the XRP Ledger, Ethereum, Bitcoin, Tron, Solana, and four additional networks sent their balances to addresses controlled by the same attacker. A second wave of transfers, occurring around UTC 23:05, affected Binance wallets on Avalanche and Polygon.

Binance stated it was investigating a potential security issue, later confirming it had temporarily suspended withdrawals across several networks as a precaution. Binance affirmed user funds remain secure. The situation is ongoing; the data presented here reflects TRM’s on-chain observations as of UTC 00:30 on October 30.

Perpetrator Identification

TRM attributes this attack to North Korea’s premier hacking group, TraderTraitor. Our assessment is grounded in credible on-chain and off-chain intelligence. The FBI previously identified this group as responsible for the $1.5 billion Bybit breach in February 2025. Multiple characteristics of this attack align with prior North Korean-linked breaches—including the Bybit incident and the KelpDAO breach in April 2026: funding operational wallets with small withdrawals from Tornado Cash, early deployment of infrastructure, pre-obtained signatures executed en masse. However, the laundering strategy observed—large-scale swaps via market makers and lending protocols—differs from the cross-chain bridge-centric model seen after the Bybit incident. TRM will share further findings as the investigation progresses.

Amount Stolen

TRM has tracked every transaction from Binance-controlled wallets to attacker-controlled addresses across ten blockchains. Valued at the moment each asset was moved, the total amounts to approximately $6.36 billion. At current prices, the same assets are worth about $6.23 billion.

Ethereum accounts for ~$3.79 billion, including 200,630 ETH and 185 other tokens—among them 187.5 million USDT, 82.3 million USDC, and 88.5 million RLUSD. Bitcoin outflows totaled 18,270 BTC, valued at ~$1.47 billion. Tron saw outflows of 612.7 million USDT and 46.4 million TRX, amounting to ~$628 million. XRP Ledger lost 233.46 million XRP (~$296 million). Solana saw outflows of 970,500 SOL (~$9.6 million). Arbitrum, Optimism, and Base combined account for ~$3.9 million, including 74.6 million ARB on Arbitrum. Avalanche outflows totaled ~$28 million, and Polygon ~$10 million.

Attack Execution Methodology

Preparations began at least 36 hours before the breach. Starting October 28 morning, the attacker’s operational wallet received three small withdrawals from Tornado Cash—a service used to obfuscate the origin of crypto assets. At around 02:00 UTC on October 29, the attacker deployed initial attack code and tested it on two wallets. Later that day, they ran a final test on a third wallet before returning the test funds to themselves. Four hours after the test concluded, the same code was installed onto a Binance hot wallet.

The first theft occurred on the XRP Ledger. Between UTC 20:05 and 20:09, five Binance wallets transferred 233.46 million XRP to a single attacker address, leaving each wallet with only the minimum reserve balance. These XRP have not moved since. Just past UTC 20:10, Binance wallets on Solana and Optimism followed suit. By UTC 20:20, a Binance Bitcoin hot wallet transferred 18,270 BTC to the attacker’s address. Within the same block, the funds were split into integer multiples of 1,000 BTC and 100 BTC—this technique, known as “peel chain,” complicates tracing. Less than two minutes later, a Binance Tron hot wallet sent 612.7 million USDT and 46.4 million TRX to the attacker.

How the Attacker Compromised Binance Hot Wallets

Hot wallets are online wallets used by exchanges to process customer withdrawals. This particular Ethereum hot wallet is one of Binance’s most well-known wallets.

EIP-7702 was introduced in May 2025 with the Ethereum Pectra upgrade, enabling a standard wallet to delegate control to a smart contract via a signature. Once delegated, every subsequent interaction with the wallet executes the contract’s code, and this arrangement remains active until a new authorization is signed.

At UTC 20:20, the attacker submitted a transaction containing 50 authorizations. Each was signed by the Binance hot wallet and directed to a sweep contract that only accepts instructions from the attacker. Wallets maintain a nonce count for each transaction; an authorization is only valid if it matches the current nonce at execution. The Binance hot wallet continuously processed withdrawal requests, incrementing its nonce. By pre-signing 50 consecutive nonces, the attacker ensured at least one would remain valid at execution time—exactly what was needed. These signatures were batch-generated in advance.

3 minutes and 24 seconds after delegation took effect, the attacker instructed the Binance hot wallet to transfer its entire balance to an attacker-controlled address. This single transaction moved 167,464 ETH and 63 other tokens, including 161.5 million USDT.

The delegation remained active. Whenever new funds arrived, the attacker swept them again—at UTC 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56. The wallet also served as the executor for another Binance smart account, enabling the attacker to withdraw 82.3 million USDC. Circle quickly froze this batch afterward.

Evidence Points to Binance’s Signing Infrastructure Breach

Early on-chain signs suggest the attacker may have obtained authorizations via phishing. However, this explanation only covers Ethereum activity and fails to account for other chains. In the same time window, Binance wallets on the XRP Ledger (five wallets), Arbitrum, Avalanche, Optimism, and Base, a Binance Bitcoin hot wallet, a Binance Tron hot wallet, and a Binance Solana wallet all transferred funds to the attacker via standard signed transactions. Another Binance Ethereum hot wallet also transferred 28,006 ETH, 55.7 million USDT, and 25.9 million RLUSD without delegation. About two and a half hours later, at UTC 23:05, Binance wallets on Avalanche and Polygon followed suit.

These wallets span different chains, use distinct key types and signing schemes. All generated valid signatures for the attacker within ~30 minutes. TRM assesses the most plausible explanation is that the attacker gained the ability to force Binance’s hot wallet signing system to generate cross-chain signed transactions according to their intent. The presence of 50 pre-signed authorizations suggests this access may be time-limited or require approval through a centralized system. Binance has not yet disclosed the root cause.

Stablecoin Freezes and Asset Conversion

Stablecoin issuers acted swiftly, expanding freezes throughout the night. By UTC 23:35, Binance reported verified freeze totals reached $2.54 billion. Including subsequent freezes, TRM tallied on-chain freezes at approximately $2.7 billion by UTC 00:30:

Tether: ~177 million USDT. Tether froze 97.11 million USDT in the primary receiving wallet at UTC 21:01—37 minutes after the main sweep. Subsequent sweep funds flowed into this frozen wallet, which now holds 117.5 million USDT. Tether also froze 20.5 million USDT in two additional Ethereum-based attacker wallets, 37.87 million USDT in two Tron-based attacker wallets, 8.4 million USDt on Avalanche, and 6.2 million USDT0 on Polygon.

Circle: ~825 million USDC. Circle, in coordination with law enforcement, froze 82.3 million USDC in the primary receiving wallet at UTC 21:04. It subsequently froze 1.56 million USDC that the attacker had exchanged from AVAX and bridged from Avalanche to Ethereum.

Ripple: 40.5 million RLUSD. Ripple froze a wallet holding stolen RLUSD at UTC 22:01, when 40.5 million of the original 88.5 million RLUSD remained. It also froze RLUSD in the compromised Binance hot wallet, preventing future sweeps. Binance Co-CEO He Yi stated Ripple helped prevent the transfer of ~$200 million in funds; TRM has confirmed on-chain freezing of 40.5 million RLUSD.

World Liberty Financial: 27.8 million USD1. World Liberty Financial froze 27.8 million USD1 in the primary receiving wallet at UTC 22:10 and another 27.8 million USD1 in the compromised Binance hot wallet at UTC 22:26.

Arbitrum Security Council: 8,426 ETH and 74.6 million ARB. The Arbitrum Security Council—a body authorized to take emergency action on Arbitrum—exercised its powers at UTC 00:08, forcibly executing two transactions to remove 8,426 ETH and 74.6 million ARB (~$30 million) from the attacker’s control.

In the initial hours, the attacker paid a steep premium to convert traceable stablecoins into assets no issuer can access. Approximately 325 million USDT were sold via UniswapX and other intent-based contracts to professional traders and market makers, yielding ~122,300 ETH. This implies an effective price near $2,650 per ETH—over 10% above the prevailing market rate of $2,300–$2,350. The remaining 175 million USDT were frozen.

The attacker’s secondary wallet deposited 60 million USDT into the lending protocol Aave and borrowed ~19,760 ETH as collateral. Aave then froze the affected markets. On Tron, 300 million USDT were transferred to a wallet initiating deposits into the lending protocol JustLend. An additional 200 million USDT passed through a chain of jump wallets on Uniswap, with 30 million USDT frozen along the way. 88.5 million RLUSD underwent two hops before entering a wallet, where 48 million were sold via decentralized exchanges between UTC 21:42 and 22:01—until Ripple froze the remaining 40.5 million.

As ETH consolidates into a few wallets and 18,270 BTC flows through peel chains, the attacker controls approximately $2.4 billion in assets beyond any issuer’s reach. Based on historical patterns of large-scale breaches, TRM anticipates the next phase will involve cross-chain bridges, swap services, and over-the-counter (OTC) brokers. TRM is monitoring peel chain output addresses and aggregation wallets to detect such movements.

Immediate Actions for Exchanges and Compliance Teams

Exchanges and compliance teams should screen deposits and counterparties against TRM’s marked attacker addresses. Funds from Bitcoin peel chains and ETH aggregation wallets are likely to enter exchanges, swap services, and OTC desks in the coming days.

Funds management teams should monitor Ethereum-compatible wallets for EIP-7702 delegations—characterized by code appearing on an address that should otherwise be empty. Any such delegation on a funds wallet should trigger immediate alerts. Teams must prepare a tested, pre-approved procedure for revoking signatures.

Signing policies should reject unexpected EIP-7702 authorizations. Requesting a large number of authorizations across a specific transaction nonce range should be treated as a sign of compromise. Signing infrastructure and approval pathways should be isolated by chain and wallet hierarchy. In this incident, a single actor obtained valid signatures across ten blockchain wallets within hours.

Market makers and solvers should screen counterparty addresses before executing large orders. Approximately 325 million USDT were sold by a wallet that received the funds just minutes earlier from the attacker. Real-time address screening could have flagged this immediately.

Frequently Asked Questions

What happened at Binance?

On October 29, 2026, an attacker transferred approximately $6.36 billion from Binance’s wallets across ten blockchains—Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon. Binance confirmed a security incident and suspended withdrawals across multiple networks.

Who is behind the Binance breach?

TRM attributes the Binance breach to North Korea’s state-sponsored hacker group, TraderTraitor, based on reliable on-chain and off-chain intelligence. The group was also responsible for the $1.5 billion Bybit breach in February 2025.

What is EIP-7702, and how was it exploited?

EIP-7702 allows a standard Ethereum wallet to delegate execution of a smart contract’s code via a signature. The attacker used a pre-signed authorization to force the Binance hot wallet to run a sweep contract that only the attacker could invoke, enabling the wallet to be emptied and continued sweeping of incoming funds.

How much stolen crypto has been frozen?

Tether, Circle, Ripple, and World Liberty Financial have frozen approximately $2.67 billion in stablecoins. The Arbitrum Security Council has frozen ~$30 million in ETH and ARB, totaling ~$2.7 billion in frozen assets. The attacker still controls over 420,000 ETH and 18,270 BTC—valued at ~$2.4 billion—plus smaller holdings across other chains.

How does this compare to other major breaches?

At ~$6.36 billion, this is the largest recorded crypto theft in history—four times the scale of the $1.5 billion Bybit breach in February 2025. Even after accounting for frozen stablecoins, the attacker currently holds more than in any prior breach.

Author: TRM Team, Translated by DeepTide TechFlow