About $6.36 billion (valued at the time of theft, per TRM) was moved out of Binance wallets on 29 October 2026, across ten blockchains, according to TRM Labs. TRM calls it the largest crypto theft on record, roughly four times the $1.5 billion Bybit theft of February 2025, and attributes it to North Korea’s TraderTraitor unit “with high confidence”. Binance has not named an actor.
What happened
TRM’s on-chain timeline, in UTC: small Tornado Cash withdrawals funded the attacker’s operator wallet on 28 October. Attack code was tested on other wallets early on 29 October. From 20:05, five wallets sent 233.46 million XRP to one address, and at 20:20 a Bitcoin hot wallet sent 18,270 BTC. On Ethereum, the attacker used EIP-7702 delegation so that a Binance hot wallet ran a sweeper contract only the attacker controlled.
From that pattern TRM concludes the compromise was of “Binance’s hot wallet signing infrastructure”. That is TRM’s inference from on-chain behaviour, not a Binance finding.
Binance, as reported by BleepingComputer (we could not open Binance’s own statement), linked the theft to a compromised laptop belonging to a DevOps engineer. Attackers reached a service container and submitted unauthorised withdrawals. Per that report, co-CEO Richard Teng said it was not a single one-click action; the report also says Binance has found no evidence a wallet private key leaked and has found additional points of breach. We could not confirm the exact wording against the article text. Binance says user funds are safe and it will cover losses. Neither source reconciles this with TRM’s reading.
Attribution
TRM cites similarities to the Bybit and KelpDAO thefts: small Tornado Cash funding, early staging and pre-obtained signatures. The FBI previously tied TraderTraitor to Bybit. BleepingComputer reports that Chainalysis also assessed with “a high degree of confidence” that TraderTraitor is responsible; we did not open Chainalysis’s own statement. Our earlier profile of the group is in Lazarus Group / TraderTraitor.
Money movement
TRM counts about $2.7 billion frozen as of 00:30 UTC on 30 October, including about 1.77 billion USDT (Tether) and 825 million USDC (Circle). The attacker sold about 325 million USDT at a discount TRM puts at more than 10%. TRM says the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion no issuer can freeze. TRM’s page does not reconcile the total against these figures; on our arithmetic, about $1.26 billion is unaccounted for there. TRM says the laundering so far differs from the bridge-heavy pattern after Bybit. Its attribution rests on “robust on and off-chain intelligence” that it does not detail.
What it means for finance
- Our assessment, with root cause still unpublished: both TRM’s signing-infrastructure reading and Binance’s DevOps-laptop account point at the systems around the keys rather than the blockchain itself. Treat developer and DevOps endpoints with deploy or signing reach as tier-zero assets.
- Stablecoin issuers froze a large share quickly; exchanges and custodians should have pre-agreed issuer contacts.
- Our assessment: the Bybit-like pattern TRM describes (Tornado funding, early staging, pre-obtained signatures) is now repeating at roughly four times the scale, so assume this method will be tried against other exchanges and custodians.
Recommended actions
These are our recommendations, except where noted.
- Review who and what can request or approve withdrawals; require out-of-band verification.
- Alert on unexpected EIP-7702 delegations and reject unexpected authorisations (TRM’s advice).
- Harden DevOps laptops: hardware-bound credentials, no standing access to signing paths, EDR.
- Watch TRM, Chainalysis and Binance for indicators. No verifiable indicators were found as of 31 October 2026 in the sources above.