TRM Labs Exposes North Korean Hackers Behind $6.3 Billion Binance Crypto Raid -

According to US blockchain intelligence firm TRM Labs, North Korean hackers may have committed the biggest cryptocurrency theft ever when they stole over $6.36 billion worth of cryptocurrency from Binance.

TRM Labs

Based on both on-chain and off-chain intelligence, there is “high confidence” that the attack was carried out by the elite North Korean hacker group TraderTraitor.

The attacker transferred money from Binance wallets to ten different blockchains, including the XRP Ledger, Ethereum, Bitcoin, Tron, and Solana. Beginning at 20:05 UTC on October 29, 2026, the majority of the transfers occurred in about 20 minutes.

The company calculated that blockchain authorities and cryptocurrency issuers have frozen assets valued at about $2.7 billion. The attacker did, however, still possess assets valued at about $2.4 billion, mostly in Bitcoin and Ether.

A potentially compromised employee computer was identified as the access point by Binance’s preliminary investigation, which confirmed a security problem. The entire attack path has not yet been determined by the exchange.

In its most recent service update, Binance stated that while withdrawals were paused as it redesigned its withdrawal service and associated addresses, deposits were proceeding as usual. Within 48 hours, the business anticipates that withdrawals will resume.

Binance stated that it will use company cash and its Secure Asset Fund for Users (SAFU) to reimburse any losses.

How did hackers take $6.36 billion from Binance?

TRM Labs

At least 36 hours before the actual theft, preparations for the attack started.

According to reports, the attacker used tiny withdrawals from Tornado Cash, a cryptocurrency mixing service that hides the source of digital assets, to fill an operator wallet.

After deploying and testing malicious malware on multiple wallets, the attacker installed the final version on a Binance hot wallet.

An online cryptocurrency wallet is known as a “hot wallet.” These wallets are used by exchanges to handle withdrawals and other transactions from customers.

According to TRM’s study, Binance’s hot-wallet signing system, which permits transactions across many blockchain networks, may have been compromised.

The attacker used a technique called EIP-7702 on Ethereum to force a Binance hot wallet to carry out a smart contract under their control.

Through a signed authorization, the technique enables a standard Ethereum wallet to assign certain tasks to a smart contract.

TRM

Fifty pre-signed authorizations had already been created by the attacker. One of them gave the attacker the ability to alter the wallet’s transaction processing and move its contents to an address they controlled.

According to TRM, wallets on all ten blockchains quickly produced legitimate transaction signatures for the attacker. This suggested that Binance’s signature infrastructure might have been compromised.

In the first transaction, the hacked wallet moved 167,464 ETH together with 63 other tokens, including 1.615 billion USDT.

Later, more money entered the wallet and was swept by the assailant.

Binance wallets used regular signed transactions on the other nine blockchains to transfer money to attacker-controlled addresses.

However, Binance has not verified this technical justification.

According to the exchange, its investigation was tracking the entire attack route via a compromised computer that might have been the site of entry. It pledged to release a thorough report outlining the underlying cause.

Additionally, Binance claimed to have discovered no proof of a wallet private-key leak.

Who is responsible for the hack on Binance?

With a high degree of confidence, TRM Labs linked the attack to the North Korean hacking group TraderTraitor.

According to the company, their evaluation was based on parallels with past attacks connected to North Korean hackers, including the $1.5 billion heist from cryptocurrency exchange Bybit in February 2025 and the April 2026 KelpDAO intrusion.

These parallels included the execution of pre-signed transactions in a concentrated period, preparations made well in advance of the actual heist, and the use of tiny Tornado Cash withdrawals to replenish an operator wallet.

The Bybit assault was previously attributed to TraderTraitor by the FBI.

TRM did point out that the money-laundering techniques utilized following the Bybit heist were different from those seen in the Binance incident.

In the Binance case, the attacker transferred money into assets that cryptocurrency issuers were unable to directly freeze by converting substantial sums of stablecoins through lending protocols and market makers.

TRM stated that it was using its Beacon Network to track the pilfered money and notify industry partners.

The blockchain intelligence firm’s evaluation is the attribution. The attackers’ identities have not been independently verified by Binance.

How much of the cryptocurrency that was stolen has been frozen?

After the incident, assets valued at almost $2.7 billion were frozen, according to TRM Labs.

To stop the attacker from transferring the money, a number of cryptocurrency issuers and blockchain authorities took action.

Circle froze about $825 million in USDC, while Tether froze about $1.77 billion in USDT.

About $40.5 million worth of Ripple’s dollar-backed stablecoin, RLUSD, was frozen. Additionally, World Liberty Financial froze about $27.8 million in USD1.

In addition, the Arbitrum Security Council froze 74.6 million ARB tokens and 8,426 ETH, totaling over $30 million.

According to TRM’s estimate, these actions increased the overall worth of frozen assets to about $2.7 billion.

Nevertheless, some of the stolen stablecoins were converted by the attacker into assets that issuers were unable to immediately freeze.

According to TRM, market makers and trading protocols sold over $325 million in USDT for about 122,300 ETH.

Additionally, the attacker borrowed about 19,760 ETH in exchange for depositing almost $60 million in USDT into the lending protocol Aave.

An additional $300 million in USDT was sent to the JustLend lending system on the Tron blockchain.

Consequently, TRM calculated that the attacker was still in possession of almost 420,000 ETH and 18,270 BTC, totaling about $2.4 billion.

The company anticipates that over-the-counter brokers, cryptocurrency exchange services, and cross-chain bridges will be involved in the next phase of fund transfers.

Regarding the security breach, what has Binance said?

At first, Binance stated that complaints of a possible security problem were being looked into by its security staff.

Later, the business reported that about $3 billion worth of impacted assets had been blocked on-chain and estimated the overall effect to be around $6.3 billion.

A DevOps engineer’s laptop might have been compromised, according to a previous report from Binance based on its preliminary investigation. An attacker is said to have been able to access a service container and make unauthorized withdrawal transactions as a result.

The technologies and procedures that link software development and IT operations are managed by DevOps teams.

According to Binance, there was no proof of a wallet private-key leak.

The exchange pledged to use corporate cash and its SAFU fund to reimburse any losses. Additionally, it stated that after the remediation procedure was finished, it would release a revised Proof of Reserves report.

According to Binance’s most recent update, deposits were unaffected and functioning as usual.

Binance

“While our team finishes a security overhaul of the withdrawal service and its associated addresses, withdrawals are suspended.”

It also stated that it would give more updates and anticipated restoring withdrawals in 48 hours.

Additionally, Binance stated that a number of variables contributed to the problem and that its security team was tracking the entire attack path through the compromised computer that might have been the entry point.

“The root cause will be included in a thorough report that follows,” the exchange said.

What is the difference between the Bybit theft and the Binance hack?

According to TRM Labs, the Binance event is the biggest cryptocurrency theft ever, with an estimated value of $6.36 billion.

The anticipated sum is more than four times the $1.5 billion that was taken from Bybit, a cryptocurrency exchange located in Dubai, in February 2025.

The FBI identified TraderTraitor as the perpetrator of the Bybit attack, which was also linked to North Korean hackers.

The Binance incident brings to light the dangers of centralized cryptocurrency exchanges that rely on internal systems to approve transactions and store substantial quantities of digital assets.

Even though blockchain transactions can be tracked publicly, the security of the systems that authorize and sign them is still crucial.

The Binance inquiry is still in progress.

About The Author

Suraj Koli is a content specialist in technical writing about cybersecurity & information security. He has written many amazing articles related to cybersecurity concepts, with the latest trends in cyber awareness and ethical hacking. Find out more about him.”