SINGAPORE, Singapore – Cryptocurrency exchange Binance is investigating a major security breach after about $6.36 billion in digital assets moved from its wallets across 10 blockchain networks on October 29. Blockchain intelligence firm TRM Labs links the attack with high confidence to TraderTraitor, a hacking group associated with North Korea.
Binance’s early findings point to a possible breach involving an employee’s laptop and the company’s internal systems. However, the exchange has not released its full technical investigation.
The $6.36 billion figure represents the value of assets transferred from wallets linked to Binance. It does not represent confirmed customer losses or the amount the attacker still controls.
On October 30, Binance said its partners had helped freeze about $3 billion in assets. The exchange also promised to cover all losses through its Secure Asset Fund for Users, known as SAFU, and company funds. Binance said it had found no evidence that attackers stole wallet private keys.
TRM’s October 30 analysis estimated that the attacker still controlled more than 420,000 ether and 18,270 bitcoin. The firm valued those holdings at about $2.4 billion at the time. These figures reflect its latest tracing snapshot and may change as investigators follow further transactions.
About $6.36 Billion Moved Across 10 Networks
TRM said most of the transfers took place within about 20 minutes, beginning at 20:05 UTC on October 29. A second wave of transactions reached the Avalanche and Polygon networks later that day.
The 10 affected networks were Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
Ethereum recorded the largest reported outflows, worth about $3.79 billion. TRM traced approximately 200,630 ETH and hundreds of other tokens. These included about 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD.
■ Related News
Other major transfers included:
- Bitcoin: About 18,270 BTC, worth approximately $1.47 billion at the time.
- Tron: About 612.7 million USDT and 46.4 million TRX, worth around $628 million combined.
- XRP Ledger: About 233.46 million XRP, valued at approximately $296 million.
- Solana: About 970,500 SOL, worth roughly $96 million.
TRM calculated the values using prices at the time of each transfer. It said the assets were worth about $6.23 billion when it published its October 30 analysis.
The difference between the two estimates reflects changes in cryptocurrency prices and the timing of the valuation. Neither figure represents a final calculation of unrecovered losses.
Binance Suspects a Compromised Employee Laptop
Binance gave its first public explanation of the possible security breach in an October 30 update.
The exchange said its early investigation pointed to a possible compromise of a DevOps engineer’s laptop. The attacker may then have gained access to an internal service container and used it to submit unauthorized withdrawal requests.
DevOps teams manage the systems that keep digital services running. A service container is a separate software environment that runs an application or part of a system.
If an attacker gains access to a system with powerful permissions, that access may allow actions normally reserved for authorized staff or automated services.
Binance said it found no evidence that attackers leaked wallet private keys. It also promised to publish a detailed technical report after investigators complete their work.
However, several important questions remain unanswered. Binance has not explained how the attacker may have accessed the laptop, what permissions the attacker obtained or how the withdrawal requests passed through its security controls.
The exchange has also not confirmed whether the same method explains transfers across all 10 networks.
Blockchain records can show that a wallet authorized a transaction. They do not necessarily reveal who requested the transaction or how that person or system gained access.
EIP-7702 Helped Enable the Ethereum Transfers
TRM identified an unusual feature in the Ethereum transactions. Its analysis points to the use of EIP-7702, a technical standard that allows an ordinary Ethereum account to temporarily run code through a signed authorization.
In simple terms, EIP-7702 lets a regular wallet approve certain smart-contract functions without turning the wallet into a conventional contract wallet. Smart contracts are programs that run on a blockchain.
TRM said the attacker used this feature to make a Binance hot wallet carry out a large transfer operation. The firm identified 50 authorizations that had been signed in advance.
A hot wallet connects to systems that allow an exchange to process transactions quickly. Binance and other exchanges use hot wallets to handle customer withdrawals and other transfers.
These wallets support daily operations, but they also require strong security controls. An attacker who gains access to the systems that approve transactions may create serious risks.
TRM said it found ordinary signed transfers on the other nine networks. The firm believes the coordinated activity points to a compromise involving Binance’s wallet-signing systems.
However, EIP-7702 explains only part of the Ethereum activity. It does not establish the cause of every transfer across all 10 networks.
Binance’s early explanation points instead to a possible breach involving an employee’s laptop and an internal service container. The exchange’s full technical report is needed to clarify how these findings fit together.
Companies and Blockchain Networks Froze Some Assets
Stablecoin issuers, blockchain companies and network security groups helped restrict some of the transferred assets.
TRM reported that Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins linked to the incident.
The Arbitrum Security Council also took emergency action. It confirmed on October 30 that it had moved 8,425 ETH and 74,559,805.2 ARB from an address linked to the attack into a designated holding address.
The council said an ArbitrumDAO governance vote would be required to move those assets again. It also said the action did not affect other users or applications on the network.
To carry out the intervention, the council temporarily changed an Ethereum inbox contract, moved the targeted assets and then restored the original system.
Freezing assets does not mean investigators have recovered them. A freeze can stop an asset from moving through an issuer’s or network’s controls, but it does not automatically return the money to Binance or its customers.
The eventual return of frozen assets may require legal action, a governance decision or another formal process.
Binance reported about $3 billion in frozen assets. TRM provided separate figures for stablecoins and the Arbitrum intervention. These estimates cover different asset groups and may use different valuation times. They should not be added together as separate recoveries.
Some Assets Remain Outside Centralized Freeze Controls
TRM said the attacker tried to move some assets before companies could freeze them.
The firm identified large USDT sales to market makers and borrowing activity on Aave, a decentralized lending platform. Market makers buy and sell assets to provide liquidity. Lending platforms allow users to borrow against assets they deposit.
In its October 30 snapshot, TRM estimated that the attacker still controlled more than 420,000 ETH and 18,270 BTC. It valued the combined holdings at about $2.4 billion.
These assets present a different challenge from stablecoins. Tether and other stablecoin issuers can restrict certain tokens through their own systems. Bitcoin and ether do not have a central issuer with the same ability to block a wallet.
Investigators can follow transactions on public blockchains. However, tracing an asset does not give them the power to reverse a transaction or seize the funds.
TRM also traced about 18,270 BTC from a Binance hot wallet to several addresses. The firm said the attacker used a method known as a peel chain.
In a peel chain, a wallet sends part of its balance to another address while moving the remaining amount elsewhere. The attacker can repeat this process across many wallets.
This method can make tracing more difficult by spreading funds across multiple addresses. However, public blockchain records still allow investigators to follow the transactions.
Binance Suspended Deposits and Withdrawals
Binance temporarily suspended deposits and withdrawals while it carried out security checks.
The exchange said it revoked the affected address authorization. It also said it was working with law-enforcement agencies and blockchain intelligence firms to trace the assets and support recovery efforts.
Binance promised to cover all losses through SAFU and company funds. The exchange describes SAFU as an emergency fund designed to protect users during serious incidents.
This is an important commitment, but it remains Binance’s own assurance. The company has not yet provided an independent financial assessment of the incident or its full impact.
Binance also said it would publish a technical post-mortem and an updated proof-of-reserves statement after it completes the necessary work.
A proof-of-reserves report gives information about the assets an exchange holds in relation to customer balances. Its value depends on the scope of the report and the methods used to verify the figures.
Such a report could help assess Binance’s claims about customer funds. However, it would not explain how the security breach happened or prove that investigators can recover the stolen assets.
Binance’s October 30 update did not give a confirmed date for the full return of deposits and withdrawals. The exchange said it had suspended services as a precaution while it checked its systems.
The company also said it was working with law-enforcement partners to identify those responsible. That statement does not amount to an official government finding that North Korea carried out the attack.
TRM Attributes the Attack to TraderTraitor
TRM linked the Binance incident to TraderTraitor, a hacking group associated with North Korea. The firm described its confidence in the assessment as high.
Its analysis used both on-chain and off-chain information. On-chain evidence includes public blockchain records, wallet activity, transaction times and asset movements.
Off-chain information comes from outside the blockchain. It may include technical indicators, investigative material and links to earlier cyber operations.
TRM said the Binance attack shared several features with previous thefts linked to North Korea. These included small withdrawals from Tornado Cash to fund an operator wallet, preparations before the main theft and the use of signatures prepared in advance.
The firm also compared the movement of funds with the February 2025 theft from Bybit. It said the Binance attacker relied more heavily on market makers and lending platforms, rather than the bridge-based transfers seen in the Bybit case.
Chainalysis was also identified as a potential source for an independent assessment. However, this report did not establish that the firm had published a technical analysis of this specific Binance incident. Its agreement with TRM therefore remains unconfirmed.
FBI Previously Linked TraderTraitor to the Bybit Theft
The FBI attributed the February 2025 theft of about $1.5 billion from cryptocurrency exchange Bybit to North Korea.
In a public advisory dated February 26, 2025, the bureau identified the activity as TraderTraitor. It also warned that the attackers were converting and spreading the stolen assets across thousands of blockchain addresses.
That FBI finding confirms the group’s connection to the Bybit theft. It does not prove that TraderTraitor carried out the Binance incident.
No public FBI statement or formal law-enforcement finding specifically linking North Korea to the October 29 Binance attack was identified in the material reviewed for this report.
The distinction matters. Previous attacks can help investigators compare methods and identify patterns. However, those similarities do not establish responsibility for a separate incident.
The Attack Raises Wider Questions About Exchange Security
The Binance incident highlights the risks that exchanges face when they connect their wallets to internal software and employee devices.
Hot wallets allow exchanges to process large numbers of withdrawals. But protecting them requires more than keeping private keys secure.
Employee laptops, access permissions, internal software, approval systems and transaction-signing tools can all create security risks.
Binance’s early findings suggest that investigators are examining whether an attacker gained access through an employee’s laptop and an internal service container. If confirmed, this would show how a breach of operational systems could lead to major transfers without a direct theft of wallet private keys.
The incident also shows why exchanges need to work closely with stablecoin issuers, blockchain networks, market makers and law-enforcement agencies.
Fast action can stop some assets from moving. However, it cannot guarantee the recovery of every cryptocurrency. Some digital assets also lack a central issuer that can freeze individual wallets.
Binance’s promise to cover losses is another important part of the response. However, customers and regulators will need more information to assess the exchange’s financial position and the strength of its security controls.
A detailed technical report and updated proof-of-reserves information will help answer those questions.
For now, TRM’s $6.36 billion estimate measures the value of assets transferred from Binance-linked wallets. It does not represent confirmed final customer losses.
Binance says about $3 billion in assets had been frozen. TRM’s October 30 analysis estimated that the attacker still controlled about $2.4 billion in bitcoin and ether.
The suspected North Korean connection remains an intelligence assessment by TRM. The firm bases its conclusion on blockchain activity and similarities with earlier operations linked to TraderTraitor.
Until authorities publish a specific finding or investigators provide further independent evidence, the North Korean connection should remain attributed to the intelligence firm rather than presented as proven responsibility.
Reporting Credit: Based on Binance’s October 30, 2026 Security Incident Update; TRM Labs’ October 29–30, 2026 blockchain investigation and asset-tracing analysis; Arbitrum Security Council’s October 30 emergency-action announcement; and the FBI’s February 26, 2025 public advisory on the Bybit theft. The Chainalysis assessment, full Binance technical post-mortem, issuer-level freeze confirmations and a case-specific law-enforcement attribution were not independently obtained for this report.
