North Korea’s TraderTraitor group drained about $6.36 billion from Binance wallets throughout ten blockchains on October 29, 2026. TRM Labs, which printed the findings, calls it the most important crypto theft on report.
TRM Labs says the full is about 4 occasions the $1.5 billion Bybit heist of February 2025.
North Korean hackers Binance theft
In response to technical analysis printed by TRM Labs, a lot of the funds left in about 20 minutes, beginning at 20:05 UTC. Binance wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and different networks despatched their balances to a single attacker.
A second wave round 23:05 UTC hit Avalanche and Polygon. Binance suspended withdrawals on a number of networks and says consumer funds are protected.
Preparation started not less than 36 hours earlier. An operator pockets acquired small Twister Money withdrawals on October 28. The attacker then examined its code on two wallets and rehearsed on a 3rd.
About 4 hours after the rehearsal, the identical code was put in on a Binance sizzling pockets.
On Ethereum, the attacker submitted one transaction at 20:20 UTC containing 50 EIP-7702 authorizations. Every was signed by the Binance sizzling pockets and pointed it to a sweeper contract that accepted directions solely from the operator.
As a result of the pockets’s nonce saved advancing with withdrawals, the 50 consecutive nonces assured that one signature would nonetheless be legitimate.
Three minutes and 24 seconds later, the operator moved 167,464 ETH and 63 tokens, together with 1.615 billion USDT. The delegation stayed energetic, so the attacker swept new deposits once more at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.
The opposite 9 chains used extraordinary signed transfers, not delegation. These wallets use totally different key varieties and signing schemes, but all produced legitimate signatures inside about half-hour.
TRM’s evaluation is that the attacker may make Binance’s sizzling pockets signing system signal transactions of its selecting. BBC studies that Binance’s preliminary discovering factors to a compromised engineer’s laptop computer. Binance has not printed a root trigger.
Attribution rests on patterns seen in earlier heists. These embrace Twister Money funding, early staging and pre-obtained signatures executed in a single burst. These match the Bybit and KelpDAO assaults.
For background, see the sooner protection of TraderTraitor focusing on cloud platforms and the ZachXBT investigation into laundering of Lazarus proceeds.
TRM counts about $2.7 billion frozen as of 00:30 UTC on October 30, with Tether freezing about 1.77 billion USDT, Circle freezing about 825 million USDC, Ripple freezing 40.5 million RLUSD, and World Liberty Monetary freezing 27.8 million USD1.
As well as, Arbitrum’s Safety Council moved 8,426 ETH and 74.6 million ARB, about $30 million, out of the attacker’s attain.
The attacker raced the freezes. It bought about 325 million USDT to market makers for roughly 122,300 ETH, at a reduction of greater than 10%. It additionally borrowed about 19,760 ETH in opposition to USDT on Aave.
The attacker nonetheless controls over 420,000 ETH and 18,270 BTC, about $2.4 billion. The BTC is shifting by means of a peel chain. TRM expects bridges, swap companies and OTC brokers to come back subsequent.
Organizations ought to display deposits and counterparties in opposition to labeled attacker addresses, alert on any EIP-7702 delegation on treasury wallets, and preserve a pre-approved revocation technique prepared.
Safety groups should reject surprising EIP-7702 authorizations, treating requests for a lot of authorizations throughout a variety of nonces as a compromise indicator.
Moreover, groups ought to separate signing infrastructure and approval paths by chain and pockets tier, whereas market makers and solvers should display counterparties earlier than filling massive orders. The investigation is ongoing, and figures might change.
