$6.3B Binance Heist: One Breach, 10 Chains, 20 Minutes

The record for the largest cryptocurrency theft in history stood for about 20 months. On the evening of October 29, it fell by a factor of four.

An attacker moved roughly $6.36 billion out of Binance wallets across 10 blockchains, most of it in about 20 minutes, according to blockchain intelligence firm TRM Labs. That dwarfs the $1.5 billion Bybit theft of February 2025, which until this week held the title. Binance, the world's largest crypto exchange, has suspended withdrawals, says deposits were unaffected, and has pledged to cover all user losses.

Two analytics firms, TRM Labs and Chainalysis, have independently attributed the attack with high confidence to TraderTraitor, the North Korean state-sponsored unit the FBI previously named as responsible for Bybit. The group operates under the broader umbrella the industry calls Lazarus Group.

For security leaders, the headline number matters less than the shape of the attack: a compromised endpoint, a signing system that said yes to everything, and an adversary that rehearsed the whole operation before pulling the trigger.

Binance's account has evolved quickly. Early statements pointed to a compromised engineer's laptop that allowed an attacker to submit unauthorized withdrawals. Co-CEO Richard Teng reportedly described it as a DevOps engineer's machine that may have provided access to an internal service.

The company has since walked that back as a complete explanation. In a post on X, Binance said its subsequent investigation "has uncovered additional points of breach." It also said it found no evidence of any wallet private key leak, and that it will publish technical details once its investigation is complete.

Co-Founder Yi He said withdrawals were expected to resume by Sunday, with a gradual restart. Binance said roughly $3 billion of the stolen assets had been frozen on-chain with help from blockchain partners and law enforcement.

Founder Changpeng Zhao, who no longer runs the company, posted that "User funds are safe!" and said that as a shareholder, he expects all user funds to be fully covered.

Anatomy of the attack

TRM Labs' reconstruction of the theft reads less like a smash-and-grab and more like a launch sequence.

Preparation started at least 36 hours out. The attacker's operator wallet was funded through three small Tornado Cash withdrawals beginning October 28. Early on October 29, the operator deployed attack code and tested it on two wallets, then rehearsed the final version on a third wallet and routed the test funds back to itself. Four hours later, the same code landed on a Binance hot wallet.

The theft began at 20:05 UTC on the XRP Ledger, where five Binance wallets were drained down to their minimum balances. Solana and Optimism followed. At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address that immediately began splitting it into a peel chain. Within two minutes, a Tron hot wallet sent 612.7 million USDT.

On Ethereum, the attacker abused EIP-7702, a feature introduced in Ethereum's May 2025 Pectra upgrade that lets an ordinary wallet hand its behavior over to a smart contract by signing an authorization. The operator submitted a single transaction containing 50 pre-signed authorizations, each pointing the Binance hot wallet at a sweeper contract only the attacker could call. Because a busy exchange wallet's transaction count (its nonce) keeps advancing, the attacker signed 50 consecutive counts in advance to guarantee one would still be valid at execution. One was all it needed.

Three minutes and 24 seconds later, a single sweep moved 167,464 ETH and 1.615 billion USDT. And because the delegation persisted, the attacker swept the wallet again six more times over the next three and a half hours as new funds arrived.

The cross-chain picture is the tell. Early indicators suggested the Ethereum authorizations had been phished. But in the same window, Binance wallets on nine other chains, using different key types and signing schemes, sent funds to the attacker through ordinary signed transfers. In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing. The batch of 50 pre-signed authorizations suggests that access may have been time-limited or routed through a request system.

The race to freeze

What happened next was a sprint between an attacker converting freezable assets and an industry trying to freeze them.

Chainalysis framed it bluntly: billions were held in stablecoins that issuers can freeze, and it was only a matter of time before they did. The attacker tried to stay ahead by dumping stablecoins for ETH. According to TRM, about 325 million USDT was sold to market makers and solvers at an effective discount of more than 10%, a price only a thief in a hurry would accept.

The freezes came fast anyway:

• Tether froze 971.1 million USDT in the main receiving wallet 37 minutes after the main sweep, eventually freezing about 1.77 billion USDT across chains.

• Circle froze 823 million USDC in coordination with law enforcement.

• Ripple froze 40.5 million RLUSD, and World Liberty Financial froze 27.8 million USD1.

• Arbitrum's Security Council used emergency powers to force roughly $30 million in ETH and ARB out of the attacker's wallet.

Estimates of the total frozen range from about $2.7 billion (TRM Labs) to $2.8 billion (Chainalysis) to roughly $3 billion (Binance). But TRM estimates the attacker still controls more than 420,000 ETH and 18,270 BTC, about $2.4 billion in assets no issuer can touch. Even net of freezes, that alone exceeds any previous crypto theft.

Why investigators point to Pyongyang

TRM Labs said it makes its TraderTraitor attribution "with high confidence," based on both on-chain and off-chain intelligence. It cited several hallmarks shared with Bybit and the April 2026 KelpDAO hack: small Tornado Cash withdrawals funding an operator wallet, long staging periods, and signatures obtained in advance and executed in a single burst.

Chainalysis reached the same conclusion, and said its strongest evidence emerged when its investigators watched, in real time, Binance funds commingling with proceeds from last month's Bitget exploit, which had already been attributed to North Korean actors. Chainalysis CEO Jonathan Levin put it simply on social media: the DPRK is "up to their old tricks."

Chainalysis also flagged something new: laundering patterns it had not seen before, with thousands of transactions in a short window that repeatedly cycle funds among addresses, including back to earlier ones. Many addresses follow an identical sequence of receiving exactly 1 TRX, then more funds, then forwarding. The firm reads this as evidence of automated, programmatic laundering.

The scale is staggering in context. Ari Redbord, TRM's global head of policy, told Inc. that North Korea has stolen roughly $6 billion from the crypto ecosystem over five years, and took that much in a single night. Experts have long tied the regime's crypto theft to its need for hard currency under UN sanctions, including to fund its weapons programs.

The security lesson isn't about crypto

It's tempting to file this under "crypto problems." That would be a mistake.

Strip away the blockchain vocabulary and this is a familiar story: an initial foothold on an engineer's endpoint, escalation into a high-trust internal system, and a control plane that issued valid authorizations at the attacker's request across every environment it touched. TraderTraitor has a long track record of exactly this playbook, including social engineering campaigns aimed at employees of targeted firms and malicious software packages planted for developers.

Kok Tin Gan, Co-Founder and CEO of cybersecurity firm NyxLab, told the Associated Press the incident raises questions about why stronger approval controls weren't in place, describing what looked like a single signature granting the attacker a "never-expiring, full-access token" to a hot wallet. That's an outside expert's read on incomplete public evidence, and Binance has not yet released a root cause. But it maps directly to the questions any CISO should be asking about their own crown jewel systems.

TRM's own findings underline the point: in this incident, one actor obtained valid signatures for wallets on 10 chains within hours. Whatever segmentation existed did not stop a single compromise from becoming a platform-wide one.

Art Gilliland, CEO of identity management firm Delinea, is raising the alarm about the state of access governance in the modern cyber landscape given this hack and last week's PHP and LiteLLM vulnerabilities.

"The compromised credentials in the Binance breach likely had elevated permissions, otherwise the hackers would not have been able to extract over $6 billion. Once attackers get inside an organization, the damage they can make depends on what they're able to access and what that access allows them to do," Gilliland said. "The flood of incidents in the past month should push every business leader to look closely at their access controls.

He continued, "Employees, service accounts, and increasingly AI agents shouldn't have standing access to powerful permissions sitting. Give them access when they need it, and remove it when the job is done. Always assume an attacker will find a way in, and plan to limit what they can do once there. That can make the difference between a contained incident and a crisis for the whole business."

What security teams should take from this

Treat developer and DevOps endpoints as privileged infrastructure. If a single laptop can reach a service that requests signatures or approves transactions, that laptop is part of your signing perimeter. Harden it, monitor it, and assume it is a primary target for state-backed social engineering.

Segment signing authority by environment and tier. TRM recommends separating signing infrastructure and approval paths by chain and wallet tier. The general principle applies far beyond crypto: no single compromised identity or system should be able to authorize actions across every environment you run.

Make anomalous authorization requests an alarm, not a log line. A request for 50 authorizations across a range of transaction counts is not normal behavior. TRM advises treating such patterns as indicators of compromise and rejecting unexpected EIP-7702 authorizations outright.

Build for persistence, not just intrusion. The Ethereum delegation stayed in place and was reused six more times. Teams should keep a tested, pre-approved method to revoke delegated or standing access quickly, before the second and third sweep.

Pre-wire your response partnerships. The roughly $3 billion frozen happened because stablecoin issuers, analytics firms, and law enforcement moved within minutes. Organizations in any sector should know, before an incident, who they will call and what those parties can actually do.

Screen counterparties in real time. TRM noted that hundreds of millions in stolen USDT were sold to market makers minutes after the theft, and that real-time address screening would have flagged it. Exchanges, OTC desks, and swap services should expect the remaining ETH and BTC to surface in the coming days.

"Attackers do not need to steal a crypto wallet's keys if they can get the platform to authorize withdrawals for them. Binance says its initial findings point to unauthorized withdrawals through internal systems, with no evidence so far of leaked wallet keys," said Jason Soroko, Senior Fellow at Sectigo. "A blockchain can verify a transaction's signature without knowing whether the owner intended the payment. Protecting those keys therefore requires control over every system allowed to use them."

Soroko continued, "Exchanges should test whether one breach can compromise both a withdrawal request and the checks meant to stop it. Requiring several approvals offers little protection if the attacker can control them all. Independent checks on recipients, withdrawal limits and automatic pauses for unusual transfers can help contain losses. Binance's promise to cover losses matters to customers. Its investigation also needs to explain how unauthorized withdrawals passed its controls and what will prevent a repeat." 

"The $6.3 billion number is obviously going to get a lot of attention, but I believe the more important question is how the attackers were able to get from an initial compromise to moving assets at that scale," said Robert Coles, Senior Manager of Threat Intelligence Security at Black Duck. "If an engineer's laptop was the initial entry point, that's certainly relevant, however, it doesn't explain the overall impact. We must assume that endpoints and credentials are going to get compromised. The bigger question is what happened after that initial access and why the controls in place weren't enough to stop it from becoming a much larger incident."

Coles added, "I'd also be careful about getting too far ahead of the investigation on attribution. There are certainly indicators pointing toward North Korea, particularly given the history of targeting cryptocurrency organizations, but I'd like to see more of the technical details around the intrusion before drawing any firm conclusions."

"The Binance hack happened because of a compromised DevOps employee laptop," said Mayuresh Dani, Security Research Manager, at Qualys Threat Research Unit. "Was it a vulnerability or social engineering? Only time will tell. Every ransomware post-mortem has ended the same way: the attacker got in using a boring method, and the money left through crypto. So, when the biggest crypto exchange gets taken by the same boring endpoint compromise everyone else fights, the urge to say 'welcome to our world' seems like a befitting reply. More so, when crypto turned ransomware from a nuisance into an industry, and CISOs had to bear the consequences."

"Crypto solved a problem that allowed threat actors to collect the money without getting caught, as before crypto, extortion at scale had a logistics problem," Dani added. "Remove crypto from the equation and this activity turns into data-theft-and-leak schemes that never needed a payment in the first place. The engineer's laptop that led to a multi-billion-dollar loss asks a question of what your own developer endpoints can reach. This too is just a payment method and not the cause of compromise."

Bybit was supposed to be the wake-up call. Twenty months later, the same adversary returned with better preparation, faster execution, and laundering tooling investigators say they have never seen before, and walked away with four times as much.

The industry's freeze response was genuinely impressive and kept billions out of criminals' hands. But $2.4 billion in unfreezable assets is still the largest crypto haul ever, and Binance has yet to explain how one breach turned into 10. Until it does, every organization that concentrates signing or approval authority in a single system should assume it is next on someone's target list.