The cryptocurrency industry is facing what could become its most damaging security incident to date. Approximately $6.36 billion in digital assets was transferred out of Binance wallets across ten blockchain networks on October 29, 2026, in an attack that unfolded largely within 20 minutes.
Blockchain intelligence firm TRM Labs attributes the operation, with high confidence, to TraderTraitor, a North Korean state-sponsored hacking group. The scale of the incident is unprecedented, exceeding the approximately $1.5 billion stolen from Bybit in February 2025 by more than four times.
The response has been equally significant. Major stablecoin issuers and blockchain network security authorities moved to freeze approximately $2.7 billion in assets. Yet the attacker managed to convert substantial amounts into cryptocurrencies that cannot be frozen by a central issuer, leaving an estimated $2.4 billion beyond those intervention mechanisms.
Beyond the financial losses, the incident raises difficult questions about exchange security, privileged access, transaction-signing infrastructure and the ability of attackers to compromise operations spanning multiple blockchain networks.
A Record-Breaking Attack Across Ten Blockchains
The incident began at approximately 20:05 UTC on October 29, when funds started leaving Binance-controlled wallets. According to TRM Labs, the attacker targeted wallets across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
The initial wave moved billions of dollars within minutes. A second wave of unauthorized transfers followed at approximately 23:05 UTC, involving additional Binance wallets on Avalanche and Polygon.
TRM estimates that approximately $6.36 billion was transferred at the market value of the assets when they were taken. At the prices used in its subsequent assessment, the same assets were worth approximately $6.23 billion.
Binance confirmed the security incident and temporarily suspended withdrawals on affected networks while its security teams investigated. The exchange subsequently acknowledged that approximately $6.3 billion in assets had been impacted.
In its October 30 update, Binance said its initial investigation suggested that a compromised DevOps engineer’s laptop may have enabled an attacker to access a service container and submit unauthorized withdrawal transactions. The company also stated that it had found no evidence of a wallet private-key leak.
Binance later clarified that its investigation had uncovered additional points of breach and that the full attack sequence was still being examined.
The exchange has pledged to cover the financial impact using its Secure Asset Fund for Users (SAFU) and corporate funds, stating that customer funds are safe.
These statements are important distinctions: TRM’s blockchain analysis establishes the movement of assets and presents an assessment of the attack, while Binance’s investigation into the underlying infrastructure compromise remains ongoing. Binance Support+2
Who Is Behind the Binance Hack?
TRM Labs attributes the operation to TraderTraitor, a North Korean state-sponsored hacking unit associated with major cryptocurrency theft operations.
The attribution is based on a combination of on-chain and off-chain intelligence, including similarities in preparation methods, transaction patterns and the infrastructure used during previous attacks.
The group was also linked by the FBI to the February 2025 Bybit hack, in which approximately $1.5 billion was stolen. TRM identifies similarities between the Binance incident, the Bybit attack and the KelpDAO incident of April 2026.
One notable similarity involves the preparation phase. Investigators identified small withdrawals from Tornado Cash, a cryptocurrency mixing service, that funded an operator wallet before the Binance attack. The attacker then deployed and tested malicious code before executing the operation.
However, the laundering strategy observed after the Binance theft differs from the bridge-heavy approach associated with some earlier cryptocurrency heists.
The attribution remains TRM’s assessment. Binance has not publicly confirmed the identity of the attackers, and the investigation remains ongoing.
How the Attack Worked: The Compromise of Hot Wallet Infrastructure
One of the most concerning aspects of the incident is how the attacker appears to have obtained the ability to authorize transactions across multiple blockchain networks.
A cryptocurrency exchange uses hot wallets to facilitate transactions and customer withdrawals. Unlike cold wallets, which remain offline, hot wallets are connected to internet-facing infrastructure and are designed to support frequent transactions.
This makes them operationally essential but also particularly sensitive from a security perspective.
The Ethereum EIP-7702 Exploit
On Ethereum, TRM identified the use of EIP-7702, a mechanism introduced in the Pectra upgrade in May 2025.
EIP-7702 allows an externally owned account, normally a standard cryptocurrency wallet, to delegate certain execution capabilities to smart contract code through a signed authorization.
In this incident, the attacker reportedly prepared 50 pre-signed authorizations pointing to a malicious sweeper contract. The contract was designed to accept instructions only from the attacker’s operator wallet.
By preparing authorizations for 50 consecutive transaction counts, known as nonces, the attacker increased the likelihood that one authorization would remain valid when submitted.
One authorization succeeded.
Approximately three minutes and 24 seconds after the delegation, the attacker instructed the compromised Binance wallet to transfer its balance to an attacker-controlled address.
That single transaction moved approximately 167,464 ETH and 63 other tokens, including around 1.615 billion USDT.
The attacker then repeatedly swept additional funds entering the wallet. TRM also identified activity involving a Binance smart account, through which approximately 823 million USDC was transferred.
Why the Other Blockchain Transfers Matter
The incident was not limited to Ethereum.
TRM identified valid signed transactions originating from Binance wallets on several other networks. These transactions used different blockchain technologies, wallet configurations and signing mechanisms.
In TRM’s assessment, the fact that multiple wallets across ten networks generated valid transactions for the attacker within a relatively short period points to a compromise of Binance’s hot-wallet signing infrastructure.
This is a significant finding, but it should not be confused with a confirmed disclosure of stolen private keys. Binance has explicitly stated that it found no evidence of wallet private-key leakage.
The distinction matters because the compromise of a signing workflow, authorization system or privileged service can allow attackers to generate legitimate-looking transactions without necessarily extracting the underlying private keys.
For cryptocurrency exchanges, the security of transaction approval infrastructure is therefore just as important as protecting wallet credentials.TRM Labs+1
$2.7 Billion Frozen: How the Industry Responded
Following the theft, cryptocurrency issuers and blockchain security authorities moved quickly to prevent some of the stolen assets from being transferred or converted.
According to TRM Labs, approximately $2.7 billion had been frozen on-chain by October 30 at 00:30 UTC.
The response involved several major industry participants:
- Tether: Approximately $1.77 billion in USDT-related assets frozen across multiple networks.
- Circle: Approximately $825 million in USDC frozen, including the major Ethereum transfer.
- Ripple: Approximately $40.5 million in RLUSD frozen.
- World Liberty Financial: Approximately $27.8 million in USD1 frozen.
- Arbitrum Security Council: 8,426 ETH and 74.6 million ARB frozen through emergency intervention, representing approximately $30 million.
The intervention demonstrates how centralized stablecoin issuers can sometimes restrict the movement of assets by freezing specific addresses.
However, this capability is not available across every cryptocurrency.
The attacker reportedly moved quickly to exchange portions of the stolen stablecoins for ETH and other assets, including through decentralized trading services and lending protocols.
TRM identified approximately 325 million USDT sold through UniswapX and other intent-based trading mechanisms in exchange for roughly 122,300 ETH. The transactions reportedly occurred at a substantial discount compared with prevailing ETH market prices.
Another attacker-controlled wallet supplied approximately 60 million USDT to Aave and borrowed around 19,760 ETH against it.
The strategy highlights a difficult challenge for the cryptocurrency industry: freezing assets after a theft is possible in some circumstances, but attackers can attempt to convert those assets into forms that are much harder to immobilize.
According to TRM’s assessment, more than 420,000 ETH and 18,270 BTC remained under the attacker’s control, representing approximately $2.4 billion in assets beyond the reach of the issuer-based freezes described in its report. TRM Labs+1
Why This Attack Changes the Cryptocurrency Security Landscape
The Binance incident is not simply another case of stolen cryptocurrency. It highlights a broader problem facing digital asset platforms: the concentration of operational authority within infrastructure that connects multiple wallets, networks and financial services.
Three issues deserve particular attention.
1. A compromised employee endpoint can become an enterprise-wide security problem.
Binance’s initial investigation pointed to a potentially compromised DevOps engineer’s laptop. Although the full root cause has not been established, this reinforces the risks associated with privileged employee devices, developer environments and access to production infrastructure.
A single compromised endpoint can become an entry point into systems with far greater privileges than the employee’s normal workstation.
2. Transaction-signing infrastructure is a critical security boundary.
Protecting private keys is essential, but it is not enough. Exchanges must also secure the systems that prepare, approve, validate and submit transactions.
If an attacker can manipulate the transaction-signing workflow, existing wallet protections may not prevent unauthorized transfers.
3. Blockchain security increasingly depends on cooperation between competing organizations.
The rapid response from Tether, Circle, Ripple and Arbitrum demonstrates the importance of collaboration between exchanges, stablecoin issuers, blockchain networks, law enforcement and threat intelligence providers.
The incident also exposes a difficult balance between decentralization and emergency intervention. Some assets can be frozen by their issuers, while others cannot be controlled by a central authority.
For cryptocurrency businesses, this is both a technical and governance challenge.
What This Means for the Middle East and Africa
The incident deserves particular attention across the Middle East, where Dubai and Abu Dhabi are developing increasingly important virtual asset and blockchain ecosystems.
Binance FZE, the UAE-regulated entity, issued a separate security update on October 30. It stated that the incident affected hot wallets belonging to the global Binance.com platform and that the segregated wallets holding Binance FZE clients’ virtual assets were not affected.
The company also temporarily paused withdrawals as a precaution and stated that no loss involving Binance FZE client assets had been confirmed. It reiterated that any confirmed losses would be compensated.
This distinction is important for UAE customers and the wider virtual asset industry. The global incident does not automatically mean that assets held in segregated wallets of the UAE entity were compromised. Binance Announcements, Binance News
For regulators, exchanges, banks, fintech companies and virtual asset service providers across the region, the incident reinforces several priorities:
- Strong separation between corporate IT environments and digital asset custody infrastructure.
- Independent transaction approval and multi-party authorization.
- Continuous monitoring of privileged accounts and developer endpoints.
- Regular security assessments of wallet-management and signing systems.
- Tested incident-response procedures involving regulators, law enforcement and industry partners.
African cryptocurrency businesses face similar challenges, particularly those operating across multiple countries and blockchain networks. Organizations facilitating digital asset transactions should consider whether their security architecture can withstand the compromise of a privileged employee account or a critical infrastructure service.
The lesson is straightforward: digital asset security cannot rely exclusively on blockchain transparency or the protection of private keys. The systems controlling access to those assets must receive the same level of security attention.
Ten Security Measures Cryptocurrency Exchanges Should Prioritize
The Binance incident offers practical lessons for security leaders, CISOs, CTOs, blockchain developers and compliance teams. The following measures should form part of a broader digital asset security strategy.
1. Introduce strict isolation for transaction-signing infrastructure.
Keep signing systems isolated from general corporate IT, developer workstations and internet-facing services. Use hardened environments with tightly controlled communication paths.
2. Implement multi-party transaction authorization.
Require independent approval from multiple authorized individuals for high-value or unusual transactions. Avoid relying on a single employee, service account or automated workflow to authorize significant transfers.
3. Strengthen endpoint security for privileged employees.
Apply endpoint detection and response (EDR), privileged access management (PAM), device compliance checks and continuous monitoring to laptops used by DevOps engineers, administrators and security personnel.
4. Monitor unusual transaction-signing requests.
Establish behavioral monitoring for signing infrastructure. Flag unexpected transaction volumes, unfamiliar destination addresses, unusual authorization requests and transactions outside established operational patterns.
5. Monitor EIP-7702 delegations and smart contract authorizations.
For Ethereum-based treasury wallets, monitor unexpected delegations, unfamiliar contract code and suspicious authorization signatures. Maintain a tested revocation procedure and alert on unexpected changes to wallet execution behavior.
6. Separate signing permissions across blockchain networks.
Avoid concentrating authorization privileges across multiple chains in a single service or administrative environment. Apply independent security controls, approval policies and access restrictions to each wallet tier and network.
7. Establish real-time blockchain transaction monitoring.
Use blockchain analytics and threat intelligence to identify suspicious transfers, newly associated attacker addresses, unusual fund movements and potential laundering patterns.
8. Introduce withdrawal risk controls.
Apply transaction limits, destination address allowlisting, withdrawal delays for high-risk activity and additional verification for unusual transactions. Automated controls should be capable of stopping suspicious transfers before settlement.
9. Prepare an emergency asset-freezing and incident-response framework.
Establish working relationships with stablecoin issuers, blockchain security councils, exchanges, law enforcement and threat intelligence providers. Define escalation procedures before an incident occurs.
10. Conduct regular security assessments and specialized training.
Perform penetration testing, red-team exercises, infrastructure security reviews and incident-response simulations covering wallet management, privileged access and transaction signing. Invest in specialized cybersecurity training and awareness for developers, DevOps engineers, security teams and senior management.
For organizations seeking external support, Saintynet Cybersecurity provides a reference point for cybersecurity services, security consulting, vulnerability management, GRC and professional training.
What Happens Next?
The investigation and recovery effort remain ongoing.
TRM Labs is monitoring the movement of the remaining stolen assets and sharing intelligence with industry partners through its Beacon Network.
The next stage will likely involve attempts to move funds through cryptocurrency exchanges, cross-chain bridges, decentralized exchanges, lending platforms and over-the-counter brokers.
For compliance teams, this means the work is far from over. Transactions involving addresses associated with the incident may continue to appear across different blockchain networks, making timely screening and information sharing essential.
Binance, meanwhile, has committed to covering the financial impact of the incident. Its October 30 update stated that the company had set aside more than $6.34 billion in company funds, with approximately $5 billion held in the exact affected token assets, and that it was working to restore withdrawal services after completing additional security checks. Binance Support
The eventual technical post-mortem will be particularly important. It should help the wider industry understand how the attackers gained access, how transaction approvals were bypassed and which security controls need to change.
Final Thoughts: A Wake-Up Call for Digital Asset Security
The approximately $6.36 billion Binance incident is a defining moment for cryptocurrency security. Its scale, speed and cross-chain reach demonstrate how a compromise involving privileged infrastructure can translate into extraordinary financial consequences.
The reported North Korean connection, if further established, also reinforces the growing importance of state-sponsored cyber operations targeting the digital asset ecosystem.
Yet the most important lesson is not simply that cryptocurrency exchanges remain attractive targets. It is that security must extend beyond wallets and private keys to the entire operational environment responsible for managing digital assets.
For exchanges, fintech companies, institutional investors and virtual asset service providers, transaction authorization, privileged access, endpoint security and real-time monitoring should be treated as core business controls rather than optional technical safeguards.
The next major cryptocurrency theft may not follow the same attack path. Organizations that strengthen these foundations now will be better positioned to prevent unauthorized transactions and respond when an incident occurs.
Stay informed. Stay secure.
Frequently Asked Questions
1. How much cryptocurrency was stolen from Binance?
TRM Labs estimates that approximately $6.36 billion in digital assets was transferred from Binance wallets across ten blockchain networks on October 29, 2026.
2. Who is suspected of carrying out the Binance hack?
TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group. Binance has not publicly confirmed the attribution.
3. How did the attackers compromise Binance?
TRM’s analysis suggests a compromise of Binance’s hot-wallet signing infrastructure. Binance’s initial investigation pointed to a potentially compromised DevOps engineer’s laptop and unauthorized access to a service container. The full root cause remains under investigation.
4. How much of the stolen cryptocurrency was frozen?
TRM reported approximately $2.7 billion in frozen assets, involving stablecoin issuers and the Arbitrum Security Council.
5. Were Binance customers in the UAE affected?
Binance FZE stated on October 30 that its segregated client asset wallets were not affected by the incident involving global Binance.com hot wallets. It also said no loss involving Binance FZE client assets had been confirmed.
Sources and Further Reading
- TRM Labs – North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
- TechCrunch – Binance Pauses Withdrawals as Hackers Suspected of Stealing Billions in Crypto
Editorial note: Figures and attribution reflect the cited reports and statements available as of October 31, 2026. TRM’s attribution is an intelligence assessment, not a publicly confirmed government attribution. Binance’s technical investigation remains ongoing.
