Key takeaways
On October 29, 2026, an attacker drained approximately USD 6.36 billion from Binance wallets across ten different blockchains, with the majority of the activity occurring within a 20-minute window starting at 20:05 UTC. This event marks the largest cryptocurrency theft in history, surpassing the USD 1.5 billion Bybit hack from February 2025 by roughly four times. Binance has acknowledged the security breach and has temporarily halted withdrawals across several networks.
TRM attributes this operation to TraderTraitor, an elite North Korean hacking unit, citing strong on-chain and off-chain intelligence. We maintain high confidence in this assessment. TRM is currently monitoring the movement of these funds and providing alerts to partners
On the Ethereum network, the perpetrator utilized an EIP-7702 delegation to convert a Binance hot wallet into a controlled sweeper, using 50 pre-signed authorizations prepared beforehand. Simultaneously, Binance wallets on the other nine chains transferred assets to the attacker through standard signed transactions. TRM assesses that this indicates a compromise of the signing infrastructure used for Binance’s hot wallets.
Tether, Circle, Ripple, and World Liberty Financial successfully froze approximately USD 2.67 billion in stablecoins, while the Arbitrum Security Council secured 8,426 ETH and 74.6 million ARB on its network, totaling roughly USD 2.7 billion. The attacker attempted to outpace these freezes by liquidating USDT to market makers and borrowing ETH against USDT on Aave. Currently, the attacker holds over 420,000 ETH and 18,270 BTC, representing about USD 2.4 billion in assets that remain beyond the reach of any issuer.
What happened
On the evening of October 29, billions of dollars in cryptocurrency began exiting wallets associated with Binance, the world’s largest crypto exchange. Within minutes, Binance wallets across the XRP Ledger, Ethereum, Bitcoin, Tron, Solana, and four other networks transferred their balances to addresses under the control of a single attacker. A second wave of activity at 23:05 UTC <a s price at the time of the theft, the total reaches approximately USD 6.36 billion. Based on current market prices, these assets are valued at about USD 6.23 billion.
Ethereum accounts for roughly USD 3.79 billion of the total. This includes 200,630 ETH and 185 other tokens, such as 1.875 billion USDT, 823 million USDC, and 88.5 million RLUSD. Bitcoin outflows amount to 18,270 BTC, or approximately USD 1.47 billion. Tron outflows total 612.7 million USDT and 46.4 million TRX, worth about USD 628 million. The XRP Ledger saw a loss of 233.46 million XRP, valued at roughly USD 296 million. Solana outflows reached 970,500 SOL, totaling about USD 96 million. Arbitrum, Optimism, and Base combined for approximately USD 39 million, including 74.6 million ARB taken from Arbitrum. Avalanche outflows totaled about USD 28 million, while Polygon outflows reached approximately USD 10 million.
How the attack unfolded
Preparations for the theft began at least 36 hours in advance. Starting on the morning of October 28, the attacker’s operator wallet received three small withdrawals from Tornado Cash, a service used to obfuscate the origin of crypto assets. Early on October 29, the operator deployed the initial code for the attack and tested it on two wallets. Later that day, the final version was rehearsed on a third wallet, with the test funds subsequently routed back to the operator. Four hours after this rehearsal, the same code was deployed to a Binance hot wallet.
The first theft occurred on the XRP Ledger. Between 20:05 and 20:09 UTC, five Binance wallets transferred 233.46 million XRP to a single attacker address, leaving each wallet with only its minimum required balance. That XRP has remained stationary since. Binance wallets on Solana and Optimism were targeted shortly after 20:10 UTC. At 20:20 UTC, a Binance Bitcoin hot wallet transferred 18,270 BTC to an attacker address, which immediately began splitting the funds into 1,000 BTC and 100 BTC increments within the same block. This technique, known as a peel chain, makes the funds more difficult to trace. Within two minutes, a Binance hot wallet on Tron transferred 612.7 million USDT and 46.4 million TRX to the attacker.
How the attacker took over a Binance hot wallet
A hot wallet is an internet-connected wallet used by an exchange to facilitate customer withdrawals. The Ethereum hot wallet involved in this incident is among the most prominent Binance wallets.
EIP-7702, which was introduced in the Ethereum Pectra upgrade in May 2025, permits a standard wallet to delegate control of its operations to a smart contract by signing an authorization. Once signed, every interaction with the wallet executes the code within that contract, and this arrangement persists until the wallet signs a new authorization.
At 20:20 UTC, the operator submitted a transaction containing 50 authorizations. Each was signed by the Binance hot wallet and directed it to a sweeper contract that only accepts instructions from the operator. Every wallet maintains a transaction counter, known as a nonce, and an authorization is only valid at the specific count the wallet has reached when the transaction is executed. Because the Binance hot wallet processes a continuous stream of withdrawals, its nonce is constantly increasing. By preparing signatures for 50 consecutive counts, the attacker ensured that at least one would remain valid when the transaction was processed. One signature matched, which was sufficient for the attacker. These signatures were generated as a batch in advance.
Three minutes and 24 seconds after the delegation, the operator commanded the Binance hot wallet to transfer its entire balance to an address controlled by the attacker. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
The delegation remained active. As new funds arrived in the Binance hot wallet, the operator swept them again at 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56 UTC. The wallet also functioned as the executor for a separate Binance smart account, allowing the attacker to withdraw 823 million USDC. Circle froze those funds shortly thereafter.
Evidence points to Binance’s signing infrastructure
Initial observations regarding the Ethereum activity suggested that the attacker might have phished the authorizations. While this explains the Ethereum breach, it does not account for the activity on other chains. During the same timeframe, five Binance wallets on the XRP Ledger, as well as Binance wallets on Arbitrum, Avalanche, Optimism, Base, Bitcoin, Tron, and Solana, transferred funds to the attacker via standard signed transactions. Another Binance hot wallet on Ethereum transferred 28,006 ETH, 55.7 million USDT, and 25.9 million RLUSD in the same manner, without utilizing delegation. Approximately two and a half hours later, at 23:05 UTC, Binance wallets on Avalanche and Polygon were also drained.
These wallets operate across different chains, utilize various key types, and employ distinct signing schemes. Yet, all of them produced valid signatures for the attacker within a span of roughly 30 minutes. In TRM’s assessment, the most plausible explanation is that the attacker gained the ability to force Binance’s hot wallet signing system to authorize transactions of their choosing across multiple chains. The batch of 50 pre-signed authorizations suggests that access may have been time-limited or required signatures to be requested through a specific system. Binance has not yet released a root cause <a s wallet, moving 8,426 ETH and 74.6 million ARB—valued at about USD 30 million—out of the attacker's control.
During the initial hours, the attacker converted freezable stablecoins into assets that are beyond the reach of any issuer, albeit at a significant cost. Approximately 325 million USDT was sold to professional fillers and market makers via UniswapX and other intent-based contracts in exchange for about 122,300 ETH. This implies a price of roughly USD 2,650 per ETH at a time when ETH was trading between USD 2,300 and 2,350, representing a discount exceeding 10%. The remaining 175 million USDT from that batch was frozen.
A second attacker wallet supplied 60 million USDT to the Aave lending protocol and borrowed approximately 19,760 ETH, after which Aave froze the affected markets. On Tron, 300 million USDT was moved to a wallet that began supplying it to the JustLend protocol. Another 200 million USDT was moved through a series of hop wallets and swapped on Uniswap, with 30 million USDT from that chain eventually frozen. The 88.5 million RLUSD passed through two hops to a wallet that sold 48 million via decentralized exchanges between 21:42 and 22:01 UTC, until Ripple froze the remaining 40.5 million.
With the ETH consolidated into a few wallets and the 18,270 BTC moving through the peel chain, the attacker currently controls about USD 2.4 billion in assets that are beyond the reach of any issuer. Based on previous major thefts, TRM anticipates the next phase will involve the use of cross-chain bridges, swap services, and over-the-counter brokers. TRM is actively monitoring the peel chain outputs and consolidation wallets for these movements.
What exchanges and compliance teams should do now
Exchanges and compliance teams should screen all deposits and counterparties against the attacker addresses identified by TRM. Funds originating from the Bitcoin peel chain and the ETH consolidation wallets are likely to reach exchanges, swap services, and OTC desks in the coming days.
Treasury teams should monitor Ethereum-compatible wallets for EIP-7702 delegations, which appear as code at an address that should otherwise be empty. Any such delegation on a treasury wallet should trigger an immediate alert. Teams should maintain a tested, pre-approved procedure for signing a revocation.
Signing policies should be configured to reject EIP-7702 authorizations unless they are explicitly expected. A request for multiple authorizations across a range of transaction counts should be treated as a clear indicator of compromise. Signing infrastructure and approval workflows should be segregated by chain and wallet tier. In this incident, a single actor successfully obtained valid signatures for wallets across ten different chains within a few hours.
Frequently asked questions
What happened to Binance?
On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets across ten blockchains, including Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon. Binance confirmed a security incident and suspended withdrawals on multiple networks.
Who is behind the Binance hack?
TRM attributes the Binance hack to TraderTraitor, a North Korean state-sponsored hacking group, based on robust on-chain and off-chain intelligence. The same group was responsible for the USD 1.5 billion Bybit hack in February 2025.
What is EIP-7702, and how was it used?
EIP-7702 allows a standard Ethereum wallet to execute smart contract code by signing an authorization. The attacker used a pre-signed authorization to force a Binance hot wallet to run a sweeper contract that only the attacker could control, which was then used to drain the wallet and continue sweeping new funds as they arrived.
How much of the stolen crypto has been frozen?
Tether, Circle, Ripple, and World Liberty Financial have frozen about USD 2.67 billion in stablecoins, and the Arbitrum Security Council has frozen about USD 30 million in ETH and ARB, totaling roughly USD 2.7 billion. The attacker still controls more than 420,000 ETH and 18,270 BTC, worth approximately USD 2.4 billion, in addition to smaller amounts on other chains.
How does this compare to other major hacks?
At approximately USD 6.36 billion, this is the largest crypto theft on record, roughly four times the size of the USD 1.5 billion Bybit hack from February 2025. Even after accounting for the stablecoin freezes, the amount the attacker still holds exceeds any previous theft.
