Inside the Binance Hack: How $6.3 Billion Was Taken and Where It Went

The short version

• Entry point. According to Binance, a DevOps engineer's laptop was compromised. From it, the attacker reached a service container inside Binance's infrastructure and submitted withdrawal transactions that Binance had not authorised.
• Ethereum. The main Ethereum hot wallet was taken over with an EIP-7702 delegation, a feature that lets an ordinary wallet run smart-contract code, and swept by a contract only the attacker controlled.
• Nine other chains. Wallets on Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon sent funds out with ordinary signed transfers. TRM Labs reads this as a compromise of Binance's hot-wallet signing infrastructure.
• The money trail. Of about $6.36 billion taken, about $2.7–3 billion in stablecoins was frozen within hours. The attacker swapped and borrowed against the rest, and still holds more than 420,000 ETH and 18,270 BTC.
• Attribution. TRM Labs, Chainalysis, ZachXBT and Blockaid all point to North Korea's TraderTraitor, a unit considered part of the Lazarus Group.

Step 1: preparation

TRM Labs' reconstruction shows a careful build-up:

1. 28 October. The attacker's operating wallet receives three small withdrawals from Tornado Cash, a mixer that hides where the money came from. This is how the wallet gets fuel to pay network fees without a traceable link to an exchange account.
2. Early on 29 October. The operator deploys the attack code and tests it on two wallets.
3. Later that day. The final version is rehearsed on a third wallet, and the test funds are routed back to the operator.
4. About four hours later. The same code is installed on a Binance hot wallet.

Blockaid's chief executive described the attacker as "rehearsing the same takeover on test wallets hours before", as quoted by Bitcoin.com News.

Step 2: the way in

Binance's preliminary explanation is short. "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop," the exchange wrote on X. That access let "an attacker to gain access to a service container and submit unauthorized withdrawal transactions", NBC News reported. Binance said it found "no evidence of any private key leaks from wallets".

A service container is an isolated package of software that runs one internal service, here one able to submit withdrawals. The difference matters: the attacker did not need to steal the keys to every wallet if it could make Binance's own systems sign and send the transactions. In a later update Binance said several factors contributed and that its team was still tracing the full attack path, according to CyberInsider. It has revoked authorisation for the affected address and promised a detailed post-mortem.

Step 3: the Ethereum takeover with EIP-7702

Most of the money, about $3.79 billion, was taken on Ethereum, and here the attacker used a newer tool.

EIP-7702, introduced with Ethereum's Pectra upgrade in 2025, lets an ordinary wallet (an "externally owned account") point to smart-contract code and run it as if it were its own. The wallet owner grants this by signing an authorisation that names the network, the contract address and the wallet's current nonce, the counter of transactions it has sent. An authorisation only works if its nonce matches the wallet's counter at the moment it is used.

That last detail explains the most unusual part of the attack:

• At 20:20 UTC the attacker submitted one transaction carrying 50 EIP-7702 authorisations for the Binance hot wallet, signed in advance for 50 consecutive nonce values. Because the wallet kept sending normal withdrawals, its counter was a moving target; signing a range made sure one of them would match.
• One matched. The hot wallet was turned into a sweeper contract controlled only by the attacker.
• About 3 minutes 24 seconds later, the wallet's entire balance was swept out: 167,464 ETH and 63 tokens, including 1.615 billion USDT.
• The same wallet was then used to operate a separate Binance smart account, which let the attacker pull 823 million USDC.
• The attacker came back to the wallet six more times, at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC, to sweep whatever had arrived since.

A second Binance Ethereum hot wallet lost 28,006 ETH, 55.7 million USDT and 25.9 million RLUSD in ordinary transfers, without any delegation. In total TRM counts 200,630 ETH and 185 other tokens taken on Ethereum, including 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD.

Step 4: nine other blockchains

EIP-7702 exists only on Ethereum and compatible networks. It does not explain what happened elsewhere, and this is why TRM concluded that the problem lay deeper than one wallet:

On these chains, Binance wallets sent the funds with ordinary signed transactions. The wallets use different key types and signing schemes, so stealing one key would not explain all of them. TRM's assessment is that the attacker most likely compromised the infrastructure that signs Binance's hot-wallet withdrawals. That fits Binance's own description of a service container submitting unauthorised withdrawals while the private keys themselves stayed secret.

Step 5: the race to freeze

Stablecoin issuers can block tokens at a given address, and they moved fast. Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep. Circle froze 823 million USDC in the same wallet three minutes later. TRM's breakdown as of 00:30 UTC on 30 October:

The total came to about $2.7 billion. Binance later put it at about $3 billion, a figure it said "may continue to increase", according to AFP. Aave temporarily froze its affected lending markets after the attacker used them.

Native coins are a different story. No company can freeze BTC or ETH at the protocol level; the most that exchanges and services can do is refuse to accept them. That is why the attacker's first priority, as the next section shows, was to turn freezable dollars into ether as quickly as possible.

Step 6: laundering the rest

TRM's tracing shows the conversion started within the hour:

• Selling USDT for ETH at a loss. About 325 million USDT was sold through UniswapX and other intent-based trading contracts for about 122,300 ETH. That works out to roughly $2,650 per ether when the market price was $2,300–2,350, so the attacker paid more than 10% over the market to get out of a token Tether could freeze. The remaining 175 million USDT from that batch was frozen.
• Borrowing on Aave. A second attacker wallet deposited 60 million USDT as collateral on the Aave lending protocol and borrowed about 19,760 ETH against it. CoinDesk reported at least 20,000 WETH borrowed. Aave then froze the affected markets.
• Lending on Tron. 300 million USDT moved to a wallet supplying JustLend, a Tron lending platform. Another 200 million USDT passed through intermediate wallets and was swapped, with 30 million frozen on the way.
• Dumping RLUSD. Between 21:42 and 22:01 UTC the attacker sold 48 million RLUSD on decentralised exchanges before Ripple froze the wallet holding the remaining 40.5 million.
• Splitting bitcoin. The 18,270 BTC were broken into a "peel chain", a series of transactions that each split off 1,000 BTC or 100 BTC, which makes the coins harder to follow.

After all of this, TRM estimates the attacker holds more than 420,000 ETH and the 18,270 BTC, about $2.4 billion beyond the reach of any issuer, plus smaller amounts on other chains. The ether figure is higher than the 200,630 ETH taken directly from Binance partly because it includes ether bought with stolen stablecoins and borrowed on Aave. TRM expects the next stage to run through cross-chain bridges, swap services and over-the-counter brokers, and is watching the bitcoin peel chains and the wallets collecting ETH.

TRM notes one difference from earlier North Korean thefts: after Bybit, the money moved mostly through bridges, whereas this time the attacker relied on large swaps through market makers and lending protocols.

Who did it: the case for North Korea

TRM Labs assessed "with high confidence" that the attack was carried out by TraderTraitor, a North Korean state hacking unit, based on "robust on and off-chain intelligence". The public part of the evidence is a pattern TRM also saw in the Bybit hack of February 2025 and the KelpDAO hack of April 2026:

• an operating wallet funded with small Tornado Cash withdrawals;
• preparation well before the theft, including rehearsals;
• signatures or authorisations collected in advance and then used in one burst.

Other investigators reached the same conclusion. Chainalysis linked the attack to TraderTraitor, and ZachXBT named the Lazarus Group. Both cited funds mixing with an address used in the Bitget exploit of September 2026, according to AMBCrypto. Blockaid said its findings were consistent with North Korean operations.

TraderTraitor is the name the FBI used when it attributed the Bybit theft to North Korea in February 2025. The group is considered part of the Lazarus Group, which was accused of hacking Sony Pictures in 2014. TRM's Ari Redbord told Al Jazeera that theft on this scale funds weapons programmes, which makes it a global security issue.

Binance and Bybit compared

Lessons from the attack

TRM's recommendations to exchanges and custodians follow directly from how the attack worked:

• Watch for EIP-7702 delegations on treasury and hot wallets. Code appearing at an address that should have none is a red flag that needs an immediate alert.
• Keep a tested, pre-approved way to revoke a delegation, so that it can be cancelled in minutes rather than hours.
• Reject unexpected EIP-7702 authorisations, and treat a request for many authorisations across a range of nonces as a sign of compromise.
• Separate signing infrastructure and approval paths by blockchain and by wallet tier, so that one compromised service cannot sign for every chain.
• Screen counterparties. Market makers and solvers should check who they are trading with before filling very large orders.

For individual crypto users, the same ideas scale down. Do not sign wallet "upgrades", delegations or batches of approvals you did not start yourself. Keep long-term funds in a wallet whose keys you control. And treat any "Binance refund" message outside the official app and website as a phishing attempt. Part one covers what the hack means for Binance users in more detail.

Sources

• TRM Labs: North Korea steals USD 6.36 billion from Binance
• NBC News: Binance targeted in $6.3 billion crypto heist
• CyberInsider: Binance links the incident to a compromised laptop
• Bitcoin.com News: inside the Binance hack
• CoinDesk: Binance loses over $6 billion in the largest crypto hack to date
• AFP via Yahoo Finance: Binance confirms $6.3 bn hack
• AMBCrypto: Binance to resume withdrawals within 48 hours
• Al Jazeera: Binance says $6.3bn stolen in biggest crypto heist in history
• EIP-7702: Set code for EOAs
• FBI: North Korea responsible for $1.5 billion Bybit hack
• The Hacker News: Bybit hack traced to Safe{Wallet}