Blockchain intelligence firm TRM Labs attributes the October 29 attack to North Korea’s TraderTraitor group, alleging that attackers compromised Binance’s wallet-signing infrastructure and moved billions across 10 blockchains. More than $2.7 billion was frozen, but approximately $2.4 billion remained beyond issuers’ control.
The cryptocurrency industry is facing one of its largest security crises after attackers moved approximately $6.36 billion from wallets belonging to Binance, the world’s largest cryptocurrency exchange, in a coordinated operation spanning 10 blockchains.
The theft occurred on the 29th of October, 2026, with most of the funds transferred within approximately 20 minutes. The firm attributed the attack with high confidence to TraderTraitor, a North Korean hacking group, based on its analysis of on-chain transactions and other intelligence.
The incident is approximately four times the size of the $1.5 billion Bybit hack in February 2025, making it the largest cryptocurrency theft on record. Binance confirmed a security incident and temporarily suspended withdrawals on several networks. The exchange said user funds were safe but had not published a definitive explanation of the attack’s root cause in its analysis.
The operation involved extensive preparation before the funds were moved. The attackers reportedly began preparing at least 36 hours before the theft, using small withdrawals from Tornado Cash to fund an operator wallet and deploying code to test the operation.
The first major transfers occurred on the XRP Ledger, followed by activity involving Solana, Optimism, Bitcoin, Tron and other networks. The attackers allegedly used Ethereum’s EIP-7702 functionality, which allows an ordinary wallet to delegate certain operations to smart-contract code through a signed authorisation.
The attackers prepared 50 authorisations in advance and used one to redirect the wallet’s behaviour to a contract they controlled. The resulting transaction transferred 167,464 ETH and 63 tokens, including approximately 1.615 billion USDT. The attackers subsequently swept additional funds from the wallet as they arrived.
Continue reading with Eandel
Subscribe to unlock the complete story and receive your subscriber benefits.
