Binance, the world’s largest cryptocurrency exchange, has been struck by a cyberattack in which state-backed North Korean operatives drained roughly $6.36 billion (€5.85 billion) in digital assets across 10 distinct blockchains, according to leading blockchain analytics firms.
The heist represents the single largest theft in the history of the digital asset industry, about four times the $1.5 billion (€1.38 billion) taken from Dubai-based exchange Bybit in February 2025, according to TRM Labs.
According to forensic assessments released by TRM Labs and Chainalysis, the raid began at 8.05pm UTC (9.05pm Brussels time) on October 29. The vast majority of the capital was moved in a coordinated blitz lasting approximately 20 minutes.
Investigators attribute the breach to TraderTraitor, an elite cyber warfare unit operating under Pyongyang’s state intelligence apparatus.
TRM Labs said it made the attribution “with high confidence”, describing the group as a subunit of North Korea’s Lazarus Group. The FBI blamed the same unit for the Bybit theft.
Chainalysis chief executive Jonathan Levin said his investigators had found proceeds from the September hack of exchange Bitget mixed with funds taken from Binance.
Initial findings from Binance’s own investigation indicate the breach may have originated from the compromise of a company engineer’s laptop, subsequently granting the perpetrators access to Binance’s hot-wallet transaction signing architecture. The exchange said it had found no evidence of any wallet private key leak.
On the Ethereum network, where the single largest portion of capital was taken (roughly $3.79 billion or €3.49 billion), the attackers exploited Ethereum Improvement Proposal (EIP) 7702 delegation.
Using 50 pre-signed authorisations prepared in advance, the perpetrators converted a Binance hot wallet into an automated sweeper contract directly under their control. TRM Labs said preparations had begun at least 36 hours before the theft.
Simultaneously, hot wallets across nine other networks began executing rapid, automated transfers to attacker-controlled addresses.
The outflows saw the extraction of approximately 200,630 ETH and 185 other tokens on Ethereum, including $1.875 billion in USDT, $823 million in USDC and $88.5 million in RLUSD.
On the Bitcoin network, 18,270 BTC worth approximately $1.47 billion (€1.35 billion) was drained, while on Tron, transfers accounted for 612.7 million USDT and 46.4 million TRX.
The operation also captured 233.46 million XRP from the XRP Ledger and 970,500 SOL on Solana, alongside multimillion-dollar balances across Arbitrum, Optimism, Base, Avalanche and Polygon.
In the hours following the detection of the exploit, centralised stablecoin issuers and protocol administrators intervened to stem the flow of funds.
Tether, Circle, Ripple and World Liberty Financial, the crypto venture backed by US President Donald Trump’s family, acted to freeze approximately $2.67 billion (€2.46 billion) in fiat-backed stablecoins across flagged recipient addresses. Tether moved first, at 9.01pm UTC, according to TRM Labs.
In parallel, the Arbitrum network’s Security Council intervened to immobilise 8,426 ETH and 74.6 million ARB, bringing the total value of restricted or frozen funds to approximately $2.7 billion (€2.48 billion). Binance later put the frozen total at about $3 billion.
The perpetrators had anticipated administrative blacklisting, though.
While stablecoin issuers moved to halt transfers, the attackers executed rapid decentralised conversions, selling unblacklisted stablecoins into automated market makers and depositing tokens into lending protocols such as Aave to borrow native Ether, until Aave froze the affected markets.
As a result, TRM Labs reported that the hackers successfully converted and retained control over an estimated $2.4 billion (€2.21 billion) worth of unfreezable base assets, principally held in more than 420,000 ETH and 18,270 BTC.
Binance suspended withdrawals across multiple networks as security teams sought to isolate affected signing systems.
Binance co-founder and co-CEO Yi He issued a public statement confirming the breach, stating that deposits remained unaffected, the firm’s balance sheet would absorb all losses and user funds were fully backstopped through its emergency capital reserves, the Secure Asset Fund for Users (SAFU).
She said normal withdrawal operations were expected to resume within 48 hours.
A Binance spokesperson said the company was “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice”.
The scale of the incident reverberated through European and global trading desks on the morning of October 30.
Bitcoin fell by more than 3 per cent to $76,368 (€70,244), Ether declined 3.2 per cent to $2,178 (€2,003) and Binance’s native exchange token, BNB, shed roughly 5 per cent.
The breach comes as Binance faces scrutiny in the EU. The exchange did not secure a licence under the bloc’s Markets in Crypto-Assets Regulation (MiCA) before the July 1 deadline and now serves European customers from its Abu Dhabi entity.
Regulators in France, Germany and Greece are examining its reliance on a “reverse solicitation” exemption to do so, the Financial Times reported on October 1.
Western intelligence officials and sanctions monitoring bodies have long flagged Pyongyang’s cyber apparatus as a primary financing pipeline for the regime’s illicit ballistic and nuclear weapons programmes.
Chainalysis estimated in December 2025 that North Korean hackers had stolen about $2 billion (€1.84 billion) in cryptocurrency that year, a record at the time.
European Union and United States authorities have reiterated that tracing efforts remain active through coordinated multilateral cyber defence networks.
binance official post-mortem just dropped: $6.3b affected, caused by a single devops engineer's laptop getting compromised.
the corporate spin is wild: "no evidence of private key leakage."
you didn't need the private key. the attacker had remote access to your devops machine,… https://t.co/XGZglHoTQj
— CyberSatoshi 𓆙 (@XBToshi) October 30, 2026
