TRM Labs says North Korea stole $6.36 billion from Binance after at least 36 hours of preparation

Blockchain analytics firm TRM Labs said on Oct. 30 that North Korea was behind the theft of about $6.36 billion from Binance. An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes, TRM said in a blog post, adding that it "attributes the attack to TraderTraitor, North Korea's elite hacking unit." TRM said it made the judgment with high confidence. The $6.36 billion figure is based on prices at the time of each transfer, about four times the $1.5 billion Bybit hack in February 2025 and the largest theft in crypto history.

"We make this judgment with high confidence."

TRM Labs blog

The U.S. Federal Bureau of Investigation (FBI) named the same TraderTraitor group as responsible for the Bybit hack last year. Binance has not directly confirmed the North Korea link.

Tornado Cash funding began 36 hours before the attack

According to TRM, preparations began at least 36 hours before the theft. The attacker withdrew small amounts from Tornado Cash, a mixer that breaks the trail of transactions, three times to fund an operator wallet, tested code on other wallets, and then installed the same code on a Binance hot wallet (an internet-connected wallet used for withdrawals). The theft itself was concentrated in the early hours of Oct. 30 Korea time.

1. 36+ hours beforeThree small Tornado Cash withdrawals fund an operator wallet
2. Day beforeCode deployed and tested on two wallets, rehearsed on a third, then installed on a Binance hot wallet about four hours later
3. Oct. 30, 05:05 KSTFive XRP Ledger wallets send 233.46 million XRP to a single attacker address
4. Oct. 30, 05:20 KST18,270 BTC leave a Bitcoin hot wallet and 612.7 million USDT leave a Tron hot wallet
5. Oct. 30, 05:23 KSTThe entire balance of the Ethereum hot wallet (167,464 ETH and 1.615 billion USDT) moves out
6. Oct. 30, 06:01 KSTTether freezes 971.1 million USDT in the attacker's main wallet; Circle freezes 823 million USDC three minutes later
7. Oct. 30, 08:05 KSTA second wave hits Avalanche and Polygon wallets

By chain, Ethereum accounted for the largest share at about $3.79 billion, followed by Bitcoin at about $1.47 billion, Tron at about $628 million, XRP at about $296 million and Solana at about $96 million.

Fifty pre-signed authorizations turned the wallet into a sweeper

TRM pointed to EIP-7702 as the tool used to drain the Ethereum wallet. Introduced in Ethereum's Pectra upgrade in May 2025, the feature lets a regular wallet delegate authority so it behaves like a smart contract. The attacker prepared delegation signatures for 50 consecutive transaction numbers (nonces) and submitted them at once; about 3 minutes and 24 seconds later, the wallet's entire balance was gone. The attacker also used the wallet to pull 823 million USDC from a separate Binance account. Because the other chains were drained through standard signed transfers, TRM assessed that Binance's hot wallet signing infrastructure had been compromised.

Binance said on its official X account at around 11:25 a.m. KST on Oct. 30 that its "initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It added that it had "found no evidence of any wallet private key leak," and estimated the total impact at about $6.3 billion.

$2.4 billion in ETH and BTC that no issuer can freeze

By TRM's count, about $2.7 billion had been frozen as of 9:30 a.m. KST on Oct. 30. Tether froze about 1.77 billion USDT and Circle about 825 million USDC, while Ripple (40.5 million RLUSD), World Liberty Financial (27.8 million USD1) and the Arbitrum Security Council (about $30 million) also froze funds. Binance put its verified frozen total at about $3 billion.

The rest of the funds are already being laundered. According to TRM, the attacker swapped 325 million USDT for about 122,300 ETH via UniswapX, paying roughly $2,650 per ETH, above the market price of $2,300 to $2,350. The attacker also deposited about 60 million USDT on Aave to borrow 19,760 ETH, and moved 300 million USDT to JustLend on Tron. The attacker still holds more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion. Because these coins have no issuer, there is no way to freeze them. Chainalysis CEO Jonathan Levin also named TraderTraitor as the suspect, Cointelegraph reported.

Deposits reopen, Binance aims to resume withdrawals within 48 hours

At around 1:17 p.m. KST on Oct. 30, Binance said withdrawals would stay paused while it reviews and overhauls its withdrawal service and related addresses, and gave "within 48 hours" as the timeframe for resuming them. Deposits, which had also been halted in the morning, returned to normal. Binance said it would cover all losses with its Secure Asset Fund for Users (SAFU) and company funds.

Markets recovered part of their losses. On Binance, bitcoin fell from $80,848 at 5 a.m. KST on Oct. 30 to $76,500 in the 11 a.m. hour before trading at $78,604 at 3:33 p.m. At the same time, BNB was at $716 and ether at $2,250. On Upbit, bitcoin traded at 105,825,000 won and ether at 3,030,000 won, and the kimchi premium (the gap between prices on Korean exchanges and global markets) for bitcoin on Upbit versus Binance was about 0.6%.