Binance Loses About $6.3 Billion From Hot Wallets in Record Crypto Theft, With FBI Pointing to North Korea

Hackers drained about $6.3 billion to $6.4 billion from Binance's hot wallets across ten to eleven blockchains on 29 October 2026, in what blockchain analytics firms call the largest crypto theft on record. The FBI attributed the theft on 31 October to TraderTraitor, a North Korean state-sponsored group, while issuers of dollar-pegged tokens froze roughly $2.8 billion of the loot within hours.

The estimates differ by firm. Elliptic puts the theft at $6.43 billion and Binance's own estimate is about $6.3 billion. TRM Labs counts $6.36 billion, and Chainalysis says approximately $6.4 billion. Early Ethereum-only estimates were far lower, near $2.8 billion, as CryptoTicker recorded.

How did the attacker move so much so fast?

According to Elliptic, outflows began at about 20:05 UTC, when five Binance wallets on the XRP Ledger sent 233 million XRP to one attacker address. Within about 30 minutes, Binance hot wallets on Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum and Avalanche had also been drained. A second wave hit Avalanche and Polygon after 23:00 UTC. TRM Labs says most of the outflow happened in about 20 minutes from 20:05 UTC.

On Ethereum, the attacker used EIP-7702, a feature introduced in the Pectra upgrade in May 2025 that lets a wallet delegate its behaviour to a smart contract through a signed authorization. TRM Labs and Elliptic both describe a single transaction at about 20:20 UTC that carried 50 authorizations, each signed with the key of the Binance hot wallet known as Binance 14 and each using a different nonce. Because the wallet's nonce kept advancing with normal withdrawals, one of the signatures matched when executed, according to TRM Labs. About three and a half minutes later, the delegated contract swept 167,464 ETH and 63 tokens, including roughly 1.6 billion USDT.

What does Binance say went wrong?

Binance's account has shifted. Per CryptoTicker's timeline, an early update named a likely entry point: a compromised laptop belonging to a DevOps engineer, through which the attacker reached a service container and submitted unauthorized withdrawals. Binance said then that it had found no evidence of a private key leak.

Later, according to Elliptic, Binance found additional points of breach and called it a complex attack. Co-CEO Richard Teng said it "was not carried out by one person" and that the EIP-7702 delegation "did not pass through our normal approval controls." Binance has not specified the further breach points or published a root cause. TRM Labs reads the cross-chain breadth as pointing to a compromise of Binance's hot wallet signing infrastructure, which it labels an assessment.

Binance has said it will cover all losses from its SAFU fund and company funds. Elliptic reports that more than $6.34 billion has been reserved, with about $5 billion of that in the stolen tokens, and that a full Proof of Reserves report was promised by Monday. Withdrawals were paused and, Elliptic says, began reopening on 1 November, starting with Bitcoin. Elliptic also notes that $169 million left Binance after withdrawals were suspended and appears to have gone to Binance's own funds, so it is excluded from the theft total.

How much was frozen, and how much is out of reach?

The freezes were the fastest part of the response. Elliptic says Tether froze the main attacker Ethereum wallet 37 minutes after it received funds, locking 1.18 billion USDT, and then froze four more addresses within 17 minutes. Circle froze 823 million USDC three minutes later. TRM Labs adds that Ripple froze 40.5 million RLUSD and World Liberty Financial froze 27.8 million USD1.

Elliptic has verified $2.85 billion frozen or seized, about 44% of the theft, close to Binance's own figure of roughly $3 billion. Stablecoins make up 94% of that total. The Arbitrum Security Council also moved assets out of the attacker's reach, and Optimism's governance moved 44 million OP on 31 October. Chainalysis says billions more were held in assets such as Bitcoin and ether that no issuer can freeze.

Chainalysis says the attacker swapped $325 million in stablecoins for $285 million in ETH within about 20 minutes to outrun freezes. Elliptic estimates about $3.25 billion across more than 800 addresses cannot be frozen by an issuer, including about 584,000 ETH, 18,327 BTC and 233 million XRP. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because those native assets have no issuer able to freeze them. TRM Labs puts the attacker's holdings beyond issuer reach at about $2.4 billion on its earlier count.

Who was behind it?

On 31 October the FBI attributed the theft to TraderTraitor, according to Elliptic, which notes that the bureau previously attributed the Bybit and DMM Bitcoin thefts to the same group. TRM Labs and Chainalysis had reached the same assessment earlier. TRM Labs said it did so "with high confidence." Chainalysis called its conclusion an "intelligence assessment" and said the strongest evidence was that stolen Binance funds commingled in real time with proceeds of the September Bitget theft, which had been tied to North Korean actors.

Elliptic cites similarities to the February 2025 Bybit theft of $1.46 billion: long preparation, apparent targeting of staff and use of the victim's own signing systems. It also points to the scale, saying few actors could coordinate across 11 chains in about three hours. Binance itself, in the early reporting CryptoTicker summarised, named no perpetrator.

What happens next?

Laundering is under way. Elliptic says the attacker's main Tron wallet made 1,113 transfers between 30 October and 1 November, with a median gap of 90 seconds, a pattern it reads as scripting. Some of the 638 million TRX obtained on Tron was sent across at least six bridges, mostly ending as ETH, and Elliptic has matched about $122 million of bridge outputs. The 18,270 BTC was split through a peel chain into 19 addresses, mostly of 1,000 BTC each, and none has reached a service yet.

What we don't know yet

Several material points are unresolved. Binance has not published a root cause or named the additional breach points. The attribution to North Korea rests on the FBI's statement and on analytics firms' assessments, the evidence for which they have not fully disclosed. Totals depend on whether assets are valued at transfer time or current prices, and the frozen figure changes as tracing continues. TRM Labs' account is explicitly labelled as still developing, and Elliptic says it will track laundering in a separate report.