Binance’s $6.3 billion hack: how the record theft unfolded

Hackers took about $6.3 billion from Binance wallets on Oct. 29, the exchange said, in a theft that blockchain firm TRM Labs calls the largest crypto hack on record. The Associated Press reported that Binance set aside more than $6.34 billion in company funds to cover stolen assets and worked with partners to freeze roughly $3 billion.

• TRM tracked about $6.36 billion moving across ten blockchains.
• Most of the transfers took place in about 20 minutes, starting at 20:05 UTC.
• Binance’s previous largest comparison was the $1.5 billion Bybit theft in February 2025.

How did attackers move funds from Binance wallets?

TRM says the attackers used a different method on Ethereum than on the other nine affected blockchains. On Ethereum, they used a feature called EIP-7702 to make a Binance hot wallet—an online wallet used to move crypto—send funds to an attacker-controlled address.

TRM says the attackers prepared 50 authorisations in advance. On the other nine chains, Binance wallets sent funds through ordinary signed transfers. The pattern led TRM to assess that Binance’s hot-wallet signing system had been compromised; the company has not publicly confirmed that explanation.

Binance initially said its investigation pointed to a compromised laptop, then reported finding additional “points of breach.” Co-CEO Richard Teng said the attack involved complex tactics and more than one person, according to AP. The investigation was ongoing when the exchange spoke to AP.

Who does TRM suspect was behind the theft?

TRM attributed the attack to TraderTraitor, a North Korean hacking group, saying it had high confidence in that assessment. The firm cited similarities with earlier North Korea-linked heists. Chainalysis also considered TraderTraitor a likely culprit, AP reported.

That attribution is an assessment by blockchain intelligence firms, rather than a conclusion Binance had confirmed. The exchange told AP it was working with law enforcement to identify the criminals. TRM says the FBI had previously named TraderTraitor as responsible for the 2025 Bybit hack.

How much of the stolen crypto was frozen?

Binance and its partners froze roughly $3 billion in affected assets, according to AP. TRM’s more detailed accounting put the amount frozen at about $2.7 billion, including stablecoins frozen by issuers and assets blocked on the Arbitrum network. Stablecoins are tokens designed to track the value of currencies such as the US dollar.

Some funds remained in motion. AP reported that analyst Garrick Hileman saw evidence that attackers were transferring and converting part of what had not been recovered. Mixing crypto with other funds can make it harder to trace, he said.

Binance said deposits were unaffected and promised to cover customer losses, AP reported. At the time of that report, withdrawals had been suspended, with the exchange expecting to resume them within a day or two. The theft also raised questions about controls around hot wallets, which hold the keys needed to approve online transfers.

Sources and documents

• The Associated Press reported — apnews.com