.
Key Points
- On October 29, 2026 at approximately 20:05 UTC, attackers drained $6.36 billion from Binance hot wallets across 10 blockchains in roughly 20 minutes. TRM Labs calls it the largest crypto theft on record, approximately four times the $1.5 billion Bybit hack of February 2025.
- TRM Labs attributes the attack to TraderTraitor, a North Korean state hacking unit, with high confidence. ZachXBT separately named the Lazarus Group as the likely attacker. The same group was linked to the Bybit hack.
- On Ethereum, the attacker exploited EIP-7702, a feature introduced in the Pectra upgrade, to convert a Binance hot wallet into a sweeper contract they controlled using 50 pre-signed authorizations batched into a single transaction.
- Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop as the entry point. Binance says it found no evidence of private key leakage.
- Approximately $2.7 billion has been frozen on-chain by Tether, Circle, Ripple, World Liberty Financial, and Arbitrum’s Security Council. The attacker still holds roughly $2.4 billion beyond issuers’ reach, primarily in ETH and BTC.
- Binance has suspended withdrawals, engaged law enforcement and blockchain intelligence partners, and says all losses will be covered by the SAFU fund and company funds. Co-CEO Yi He confirmed no user losses.
At 20:05 UTC on October 29, 2026, funds began leaving Binance hot wallets. By 20:25, $6.36 billion was gone across ten blockchains. The attack lasted approximately twenty minutes. TRM Labs, which tracked the flows in real time, calls it the largest crypto theft in recorded history, roughly four times the scale of the Bybit hack that North Korea pulled off eight months earlier in February 2025.
Binance confirmed the incident the same day, suspended withdrawals across affected networks, and said it was working with blockchain intelligence firms and law enforcement to trace and recover funds. Co-CEO Yi He stated the exchange would cover all hacking losses. The SAFU fund, Binance’s emergency reserve holding approximately $1 billion in Bitcoin, was cited as one coverage source alongside company funds.
As of October 30, approximately $2.7 billion has been frozen through coordinated action by Tether, Circle, Ripple, World Liberty Financial, and Arbitrum’s Security Council. The attacker still holds more than 420,000 ETH and 18,270 BTC, roughly $2.4 billion in assets that stablecoin issuers cannot reach.
How It Happened: EIP-7702, Compromised Signing Infrastructure, and 36 Hours of Preparation
TRM Labs’ on-chain reconstruction shows the attacker began preparing at least 36 hours before the theft. Small withdrawals from Tornado Cash funded an operator wallet. On October 29, the attacker tested code across two wallets, rehearsed the final version on a third, and then installed it on a Binance hot wallet approximately four hours before execution.
The Ethereum attack used EIP-7702, a new feature introduced in Ethereum’s Pectra upgrade. EIP-7702 allows an externally owned account, a standard wallet, to temporarily delegate its behavior to a smart contract. The attacker submitted a single transaction carrying 50 pre-signed authorizations, each for a different transaction nonce. Because the wallet’s nonce advances with every transaction, the batch was designed so that at least one authorization would remain valid regardless of on-chain state. The wallet was effectively converted into a sweeper contract under the attacker’s control. Three and a half minutes later, the entire balance, 167,464 ETH and 63 tokens including 1.615 billion USDT, was drained in one sweep.
What is EIP-7702?
EIP-7702, introduced in Ethereum’s Pectra upgrade, allows a standard wallet (EOA) to delegate its behavior to a smart contract for the duration of a transaction. Designed to improve user experience, it can be exploited if an attacker obtains signing authorization for a target wallet. In this attack, 50 pre-signed authorizations across different nonces were batched so one would always be valid, enabling the attacker to fully control and drain the wallet.
On the nine other chains, the attack used ordinary signed transfers rather than EIP-7702. TRM Labs concludes this most likely indicates the attacker compromised Binance’s hot wallet signing infrastructure directly, rather than exploiting any single protocol vulnerability. Binance’s own preliminary finding points to a DevOps engineer’s laptop as the entry point, which may have given the attacker access to a service container used to submit unauthorized withdrawal transactions. Binance states no private key leak has been found.
What Was Stolen: Chain by Chain
Funds Drained by Blockchain
Values at time of transfer, October 29, 2026. Source: TRM Labs on-chain analysis.
| Chain | Amount Stolen | Key Assets | Time (UTC) |
|---|---|---|---|
| Ethereum | ~$3.79B | 200,630 ETH, 1.875B USDT, 823M USDC, 88.5M RLUSD + 185 tokens | ~20:20 |
| Bitcoin | ~$1.47B | 18,270 BTC, split via peel chain | ~20:20 |
| Tron | ~$628M | 612.7M USDT, 46.4M TRX | ~20:20 |
| XRP Ledger | ~$296M | 233.46M XRP across 5 wallets | 20:05 |
| Solana | ~$96M | 970,500 SOL | After 20:10 |
| Arbitrum / Optimism / Base | ~$39M | 74.6M ARB on Arbitrum + others | After 20:10 |
| Avalanche | ~$28M | Second wave, ~23:05 | ~23:05 |
| Polygon | ~$10M | Second wave, ~23:05 | ~23:05 |
North Korea Attribution: TraderTraitor and the Bybit Playbook
TRM Labs attributes the attack to TraderTraitor, the North Korean state-sponsored hacking unit the FBI previously linked to the Bybit hack, with high confidence. ZachXBT independently named the Lazarus Group. Both point to the same state infrastructure operating under different operational unit names.
The attribution rests on several patterns TRM identified. Small Tornado Cash withdrawals funding an operator wallet in the preparatory phase is a signature seen in prior North Korea-linked heists. The collection of signatures well in advance and their execution in a single coordinated burst matches the Bybit operational template. The post-theft behavior, however, differs from Bybit’s bridge-heavy laundering pattern. The attacker converted some freezable stablecoins into ETH at a steep discount rather than waiting for freezes to execute. They also borrowed 20,000 WETH against stolen USDT on Aave, creating an additional layer of on-chain complexity.
“North Korea steals $6.36 billion from Binance in the largest hack in history. We attribute this attack to TraderTraitor with high confidence.”
TRM Labs | October 30, 2026
TRM expects the next laundering stage to involve cross-chain bridges, swap services, and OTC brokers. The attacker still controls over 420,000 ETH and 18,270 BTC, assets that are on-chain visible but beyond any issuer’s ability to freeze unilaterally.
What Has Been Frozen and What Remains At Large
On-Chain Freeze Status
As of October 30, 2026, 00:30 UTC. Source: TRM Labs.
| Party | Amount Frozen | Asset |
|---|---|---|
| Tether | ~$1.77B | USDT |
| Circle | ~$825M | USDC |
| Ripple | 40.5M RLUSD | RLUSD |
| World Liberty Financial | 27.8M USD1 | USD1 |
| Arbitrum Security Council | 8,426 ETH + 74.6M ARB | ETH, ARB |
| Still at large | ~$2.4B | 420,000+ ETH, 18,270 BTC |
Market Impact and Binance’s Response
Markets moved immediately on the news. Bitcoin fell 4.8% to below $77,000. Ether dropped 5.7%. BNB fell 8% and AAVE dropped 11%, the latter partly because the attacker had borrowed WETH against stolen USDT on the Aave protocol, creating liquidation risk exposure. The attacker’s Aave position amounted to at least 20,000 WETH, approximately $44 million, borrowed using frozen stablecoin collateral.
Binance held approximately $144 billion in total assets before the incident per DefiLlama, making the $6.36 billion loss roughly 4% of its total reserves. The SAFU fund was established in 2018 specifically for emergencies of this kind and has been periodically topped up. Co-CEO Yi He’s confirmation that all losses would be covered is consistent with previous Binance security incidents, though this is the largest the fund has faced by an order of magnitude.
Binance has revoked the affected address authorizations, engaged law enforcement and blockchain intelligence partners, and plans to publish a detailed technical post-mortem once the investigation is complete. An updated Proof of Reserves will follow remediation. No dates have been given for either.
Frequently Asked Questions
How much was stolen from Binance on October 29, 2026?
Approximately $6.36 billion at the time of transfer, across ten blockchains. TRM Labs calls it the largest crypto theft on record, roughly four times the $1.5 billion Bybit hack of February 2025. The attack took approximately 20 minutes from first movement to completion.
Who carried out the Binance hack?
TRM Labs attributes the attack to TraderTraitor, a North Korean state-sponsored hacking unit, with high confidence. ZachXBT separately named the Lazarus Group. Both refer to North Korean state cyber infrastructure. The same group was linked to the Bybit hack in February 2025.
What is EIP-7702 and how was it used in this attack?
EIP-7702, introduced in Ethereum’s Pectra upgrade, allows a standard wallet to delegate its behavior to a smart contract. The attacker used it to convert a Binance hot wallet into a sweeper contract they controlled, using 50 pre-signed authorizations across different nonces batched into one transaction. The design guaranteed at least one authorization would always be valid, enabling full drainage of the wallet in a single sweep.
Are Binance user funds safe?
Binance says yes. Co-CEO Yi He confirmed the exchange will cover all hacking losses using the SAFU fund and company funds. The SAFU fund holds approximately $1 billion in Bitcoin and was established specifically for this purpose. Withdrawals remain suspended pending completion of security checks.
How much of the stolen funds has been recovered or frozen?
As of October 30, approximately $2.7 billion has been frozen through coordinated action by Tether ($1.77B USDT), Circle ($825M USDC), Ripple (40.5M RLUSD), World Liberty Financial (27.8M USD1), and Arbitrum’s Security Council (8,426 ETH and 74.6M ARB). The attacker still holds over 420,000 ETH and 18,270 BTC, roughly $2.4 billion, in assets beyond issuers’ reach.
Further Reading
How North Korea-linked social engineering tactics operate at the retail level, the same playbook scaled down from exchange-level attacks to individual victims.
The October 2026 Ledger incident that preceded Binance, establishing the pattern of multi-chain simultaneous drainage attacks this month.
The regulatory and security infrastructure argument Hoskinson made at the UN General Assembly, now directly relevant as the largest hack in crypto history tests the industry’s self-governance claims.
Sources: TRM Labs (North Korea Steals $6.36 Billion From Binance, October 30, 2026), CoinDesk (Potential Multi-Billion Binance Hack, October 29, 2026), Binance Official Announcement (Security Incident Update, October 30, 2026), Al Jazeera, CNBC, Axios | Published October 30, 2026 | CryptoNewsBytes.com | Not financial advice.
