The Largest Crypto Theft On Record: $6.36 Billion Drained From Binance In About 20 Minutes

NEW YORK — An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains on Thursday evening, most of it in about 20 minutes, in what blockchain intelligence firm TRM says is the largest cryptocurrency theft on record. Two analytics firms, TRM and Chainalysis, have attributed the attack to TraderTraitor, the North Korean hacking unit the FBI blamed for last year’s $1.5 billion theft from the Bybit exchange. Binance, the world’s largest crypto exchange, says it has frozen roughly $3 billion of the affected assets, will cover all losses, and expects to resume withdrawals within a day or two.

Twenty Minutes, Ten Blockchains

The theft began at 20:05 UTC on Thursday, October 29, TRM said, as Binance wallets on Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon began sending their balances to addresses controlled by a single attacker. On Ethereum, the attacker used a technique known as an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorisations prepared in advance, TRM reported. The scale dwarfs the previous record: at about $6.36 billion, the Binance theft is roughly four times the $1.5 billion taken from Bybit in February 2025, until now the largest crypto hack ever recorded. Arkham Intelligence put the holdings of 70 wallet addresses believed to belong to the attackers at a combined $5.788 billion as of Friday afternoon, including 1.768 billion in the Tether stablecoin, 18,270 bitcoin, 497,976 ether and about 824.6 million in USD Coin.

The North Korea Attribution

“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence,” the firm said. Chainalysis reached the same conclusion: its co-founder and chief executive, Jonathan Levin, wrote that the hack was “likely done by DPRK group TraderTraitor.” TRM said several features of the attack match earlier North Korea-linked heists, including Bybit, which the FBI formally attributed to TraderTraitor last year. Binance itself has not named a culprit. Asked about the potential ties to North Korea, a Binance spokesperson said only that the company is “working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice.” North Korea has always denied involvement in cryptocurrency thefts, which Western governments say fund its weapons programmes.

A Laptop, Then More Breaches

Binance said its initial investigation suggested the incident may have involved a compromised laptop belonging to a DevOps engineer, giving the attacker access to the environment running internal services and the ability to execute unauthorised withdrawal transactions. On Friday the exchange updated that account: the subsequent investigation had uncovered additional “points of breach.” The company said it found no evidence that the private keys used to approve transfers had been exposed. The specific attack path and cause remain under investigation, and Binance has promised a full post-mortem and an updated proof of reserves.

Withdrawals Frozen, Losses Covered

Binance suspended withdrawals as a precaution while deposits remain unaffected and continue to operate as normal. Working with blockchain partners, it says roughly $3 billion in affected assets has been frozen onchain, and on Friday it said it was beginning to recover assets for users. The exchange says it will cover all losses, drawing on its Secure Asset Fund for Users, known as SAFU, alongside company funds, and expects withdrawals to resume in the next day or two after a security overhaul of its withdrawal service. TRM cautioned that recovery of the remaining funds requires a separate legal process, potentially involving court orders and coordination with token issuers — and the part of the haul that was not frozen is still moving under the attackers’ control.

Sources: TRM Labs; The Associated Press (via KNKX); Binance statements of October 29–30, 2026; Seoul Economic Daily; CCN.