Hackers drained roughly $6.3 billion in crypto from Binance hot wallets on October 29, in what blockchain analysts call the largest theft of its kind on record. Researchers at Elliptic and TRM Labs attribute the attack to North Korea’s TraderTraitor group, and Binance says it will cover the losses.
What happened
Elliptic puts the theft at $6.43 billion, while TRM Labs counts about $6.36 billion at the value of each transfer. Binance’s own estimate is around $6.3 billion. The gap comes from how and when the assets are priced. The money left Binance hot wallets across 11 blockchains over a few hours. Elliptic says the first large outflow came around 20:05 UTC, when five XRP Ledger wallets sent 233 million XRP, followed by a second wave on Avalanche and Polygon after 23:00 UTC.
Most of the value was on Ethereum, about $3.8 billion across 186 tokens, along with 18,270 BTC. Binance first said the breach may involve a compromised DevOps engineer’s laptop that gave an attacker access to a service container and let them submit unauthorized withdrawals. It later said its investigation found additional points of breach and called the attack complex. Co-CEO Richard Teng said it was not the work of one person. Binance has not said what those other points were.
Elliptic reports that the FBI has attributed the theft to North Korea and named TraderTraitor. TRM Labs reached the same conclusion with high confidence from on-chain and off-chain evidence. We could not open the FBI’s own statement, so that attribution rests on Elliptic’s account.
Why it matters
The theft is about four times the size of the $1.5 billion Bybit hack, according to TRM. It also shows how fast stablecoin issuers and other crypto firms can respond: Elliptic says $2.85 billion, about 44 percent of the total, has been frozen or seized. Tether froze the attacker’s main wallet 37 minutes after it received funds, and Circle froze 823 million USDC. Ripple, World Liberty Financial, Paxos and First Digital froze further assets.
Funds on Bitcoin, the XRP Ledger, Solana and NEAR have not been frozen. Elliptic estimates the attacker still holds about $3.21 billion in assets that cannot be frozen, so laundering attempts are expected.
What to do
Neither Elliptic nor TRM issued advice for individual users. The steps below are our analysis, not from the sources.
- If you hold funds on Binance, rely only on its official channels for updates, and treat any email, DM or support chat offering to “recover” or “verify” your funds as a likely scam.
- Turn on app-based or hardware two-factor authentication and an anti-phishing code, and review your API keys and withdrawal address whitelist.
- Keep long-term holdings in a wallet you control instead of leaving everything on an exchange.
- Businesses should screen deposits against published attacker address lists. Elliptic offers a free blocklist of more than 1,000 addresses. TRM advises treasury teams to watch for unexpected EIP-7702 delegations.
Where things stand
Binance paused withdrawals after the attack. Elliptic’s November 1 update says Binance has started reopening them, beginning with the Bitcoin network. TRM reports Binance has said user funds are safe, and Elliptic says Binance plans to cover all losses from its SAFU fund and company funds, with more than $6.34 billion reserved. Binance also planned to publish a full proof-of-reserves report by Monday.
What we still do not know
Binance has not explained the additional breach points or how attackers got from a developer laptop to the wallet systems. The FBI’s full findings were not available to us. It is also unclear how much of the unfrozen $3.21 billion can be traced or recovered, and whether Binance’s reserves report will confirm its solvency claims.
Sources: Elliptic, “Binance hack: largest in history” (Oct 30, 2026, updated Oct 31 and Nov 1); TRM Labs, North Korea steals $6.36 billion from Binance (Oct 29, 2026).
Leave a Reply