The devastating operation was pinned on TraderTraitor, an elite North Korean cyber unit that spent at least 36 hours testing systems and pulling funds from Tornado Cash prior to execution. Binance suffered its heaviest blow on Ethereum accounts, forcing temporary withdrawal halts across multiple networks even as it reassured customers regarding asset safety. Although industry administrators froze an estimated USD 2.7 billion, the hackers outpaced blacklists by dumping stablecoins to market makers and leveraging Aave. Consequently, the perpetrators managed to lock in over USD 2.4 billion worth of unrecoverable native Bitcoin and Ethereum.
Key points
Hackers bypassed emergency token freezes by selling stablecoins to market makers and borr…: Hackers bypassed emergency token freezes by selling stablecoins to market makers and borrowing funds through the Aave lending protocol.
The perpetrators successfully secured more than 420,000 ETH and 18,270 BTC that are now e…: The perpetrators successfully secured more than 420,000 ETH and 18,270 BTC that are now entirely beyond issuer control.
Binance temporarily suspended withdrawals across several networks to contain the attack w…: Binance temporarily suspended withdrawals across several networks to contain the attack while maintaining that customer funds remained safe.
Sources checked by our analysis pipeline: 1
North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
Key takeaways
- On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.
- TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.
- On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorizations prepared in advance. In the same window, Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers. In TRM's assessment, this points to a compromise of Binance's hot wallet signing infrastructure.
Wall Street faces a packed agenda of political and macroeconomic catalysts following sharp drops in major tech names spooked by costly artificial intelligence infrastructure. Upcoming congressional votes could usher in stricter regulatory oversight for financial institutions, cryptocurrency platforms, and tech developers. Traders are closely evaluating whether strong consumer spending and employment can offset deep volatility triggered by massive corporate cash burn.
Shares of Vivendi are experiencing a surge in trading today. Details regarding the specific drivers behind the sudden rise in the company's share price remain unconfirmed.