Binance Hack Update: $6.3B Stolen, North Korea's TraderTraitor Blamed

A day after Binance paused withdrawals, the picture is much clearer. Binance now estimates the theft at about $6.3 billion, roughly four times the Bybit hack. Blockchain analytics firm TRM Labs attributes it with high confidence to TraderTraitor, North Korea's elite hacking unit.

This follows our first report, Binance Hack: What We Know About the Hot Wallet Drain. Figures are from Binance and TRM Labs as of early 30 October and may still change.

How much was taken

Binance's own estimate is about $6.3 billion. TRM Labs traced about $6.36 billion at the prices when each transfer happened, spread across ten blockchains. Chainalysis puts it at $5.9 billion at the time of the theft. Either way, it is about four times the roughly $1.5 billion stolen from Bybit in 2025, the previous record.

TRM's breakdown by chain, rounded:

• Ethereum: about $3.79 billion, including 200,630 ETH, 1.875 billion USDT and 823 million USDC
• Bitcoin: about $1.47 billion (18,270 BTC)
• Tron: about $628 million, mostly USDT
• XRP Ledger: about $296 million (233 million XRP)
• Solana: about $96 million (970,500 SOL)
• Arbitrum, Optimism, Base, Avalanche and Polygon: about $77 million combined

Who is behind it

TRM Labs says it attributes the attack to TraderTraitor "with high confidence," based on on-chain and off-chain intelligence. Chainalysis has made the same link. TraderTraitor is the North Korean unit the FBI blamed for the Bybit hack in February 2025.

TRM points to the same playbook used against Bybit and KelpDAO earlier this year. The operator wallet was funded with small Tornado Cash withdrawals. The attack was staged at least 36 hours ahead, and the code was rehearsed on test wallets before it was used on Binance. Pre-signed approvals were then fired off in a burst. Binance has not confirmed the attribution.

How it happened

Binance says its initial investigation points to a compromised laptop belonging to a DevOps engineer. That gave the attacker access to an internal service that could submit withdrawals. Binance says it has found no evidence that a wallet private key leaked, and it has promised a full post-mortem.

That fits what TRM saw on-chain. This was not just one Ethereum wallet. Binance hot wallets on ten chains sent funds out within minutes, starting with XRP at about 20:05 UTC, followed by Solana and Optimism, then Bitcoin, Ethereum and Tron at about 20:20 UTC. TRM's reading is that the attacker gained the ability to make Binance's signing system sign transactions. On Ethereum, the EIP-7702 delegation we described in our first report arrived with 50 pre-signed authorizations in a single transaction.

The freeze

Binance says about $3 billion in stolen funds is now verified as frozen. The biggest pieces:

• Tether: about 1.77 billion USDT across several wallets
• Circle: about $825 million in USDC, frozen in coordination with law enforcement
• Arbitrum Security Council: about $30 million in ETH and ARB
• Ripple, World Liberty Financial and First Digital: froze their stablecoins (RLUSD, USD1 and FDUSD)

That still leaves a lot in the attacker's hands. TRM says the attacker holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion, plus smaller amounts on other chains.

Where the money is going

The attacker moved fast to get out of stablecoins that could be frozen. TRM traced about $325 million in USDT sold for ETH through UniswapX and similar services, at a price well above the market. The attacker also borrowed ETH on Aave against stolen USDT before Aave froze those markets, and supplied USDT to JustLend on Tron. The bitcoin is moving through a "peel chain" of smaller and smaller transfers. TRM expects cross-chain bridges, swap services and OTC brokers next, so exchanges and OTC desks are on alert.

Withdrawals and refunds

Binance co-CEO Yi He said the exchange expects to restore withdrawals within about two days: "We're working on improving the withdrawal service and related address controls." Deposits are working normally. Binance says it will "cover all losses," and reports say that will come from its Secure Asset Fund for Users (SAFU) and company funds.

Market reaction

As of early Friday, Bitcoin was down about 4.9% over 24 hours at around $76,900. Ether was down about 5.7% at around $2,211, and BNB was down about 8% at around $693. The Bitcoin Fear and Greed Index fell into "fear."

Stay safe

The lesson here is about keys and signing systems, not one exchange. At Gaming SZN, every payment and token launch is signed in your own wallet, and our servers never hold keys that move your funds.

Sources

• TRM Labs: North Korea steals USD 6.36 billion from Binance in the largest hack in history
• Cointelegraph: Live updates on the Binance hack
• U.Today: Binance reveals when it will resume withdrawals
• Gaming SZN: Binance Hack: What We Know About the Hot Wallet Drain