Binance lost approximately $6.3 billion from its hot wallets in a coordinated attack spanning 10 blockchains, making it the largest cryptocurrency theft recorded to date. According to TRM Labs, most of the funds moved during a roughly 20-minute burst that began at 20:05 UTC on October 29. The haul was more than four times the $1.5 billion stolen from Bybit in 2025, the previous industry record.
In its official incident update, Binance confirmed that hot wallets were compromised and temporarily suspended withdrawals while keeping deposits and unaffected services operational. The exchange said users would not bear the losses and that more than $6.34 billion had been reserved through its SAFU emergency fund and corporate treasury, with about 80% of the exposure covered at the time of the update. Binance also said its investigation had found additional breach points beyond an initial laptop-related theory, while reporting no evidence that private keys had leaked.
The mechanics point to a compromise of Binance’s signing infrastructure rather than a conventional theft of a single wallet key. TRM said the attacker prepared transactions at least 36 hours in advance and used valid signatures across nine networks. On Ethereum, the operator relied on 50 pre-signed EIP-7702 authorizations to delegate control and execute transfers at scale. The stolen assets included about $3.79 billion on Ethereum, $1.47 billion in Bitcoin, $628 million on Tron, $296 million on XRP Ledger and $96 million on Solana, plus smaller amounts on five other networks.
Rapid intervention recovered a substantial share but left billions outside the reach of token issuers. Tether, Circle, Ripple and other ecosystem participants froze stablecoins and related assets, while Chainalysis estimated that approximately $2.8 billion had been frozen by November 3. Bitcoin and ether cannot be frozen by a centralized issuer, however, and TRM reported that the attacker still controlled more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion at the time of its analysis.
TRM Labs and Chainalysis both assessed with high confidence that the operation was conducted by TraderTraitor, a cluster associated with North Korea. Chainalysis said funds from the Binance breach were commingled with proceeds from the earlier Bitget theft attributed to North Korean actors, while the scale, automation and rapid conversion of stablecoins resembled previous state-linked operations. Binance has not publicly assigned responsibility, so the attribution remains a conclusion from independent blockchain investigators rather than the exchange itself.
The breach shows that wallet security must protect the entire transaction-signing pipeline, not only private keys. Exchanges and custodians now face pressure to isolate signing authority by chain and wallet tier, impose stricter velocity and value controls, monitor EIP-7702 delegation activity and rehearse issuer-freeze coordination before an emergency. A fuller technical postmortem is still pending, but the attack has already established a new benchmark for how quickly a compromise of centralized signing systems can become a multi-chain systemic event.
