Investigators from TRM Labs and Chainalysis concluded with high confidence that the state-linked hacking unit known as TraderTraitor carried out the attack on October 29. The operation targeted Binance-controlled hot wallets on ten different blockchains, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. Nearly $6.36 billion in assets moved out of the exchange’s custody in a concentrated window beginning at 20:05 UTC.

Most of the stolen funds—around $3.79 billion—traveled on Ethereum. Bitcoin and Tron accounted for an additional $1.47 billion and $628 million, respectively. Earlier in the same attack window, 233.46 million XRP worth nearly $296 million left five Binance wallets before the main Ethereum movement began.

Attack Technique Revealed Through Blockchain Analysis

Blockaid’s security researchers traced the breach to a sophisticated use of Ethereum’s EIP-7702 standard. The attackers deployed 50 consecutive transaction counters in a single authorization request targeting Binance’s busiest hot wallet, number 14. This strategy increased the odds that one authorization would match the wallet’s current counter, allowing a malicious contract to execute transfers.

The breach succeeded with one authorization. From Binance wallet 14 alone, approximately $2.5 billion was drained, including 167,464 ETH and more than 1.6 billion USDT. Follow-on transfers then moved newly deposited funds. TRM Labs determined that the attackers may have also accessed the exchange’s transaction-signing infrastructure through other wallets.

Onchain Lens reported that the hacker immediately moved 17,260 ETH—valued at about $38.82 million—into a new receiving wallet identified as 0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea. The address still holds roughly 480,720 ETH, worth around $1.08 billion, which cannot be frozen by the token issuer.

Chainalysis and TRM both noted preparatory activity at least 36 hours earlier. An attacker-controlled wallet received small Tornado Cash withdrawals and tested malicious code before the final strike. The same code was deployed on Binance’s hot wallet four hours after a rehearsal.

Binance Response and Immediate Actions

Binance’s own assessment pointed to a compromised DevOps engineer’s laptop as the likely entry point. The incident may have involved unauthorized access to an internal service container that allowed submission of withdrawal transactions. The exchange found no evidence of leaked private keys and said it would release a full technical report once the investigation concludes.

Withdrawals remain suspended while Binance upgrades its systems and strengthens controls. The company expects services to resume within 48 hours. Deposits, however, stayed operational throughout the incident.

Binance pledged to cover customer losses using its SAFU fund and company resources while cooperating with law enforcement and blockchain investigators. Approximately $3 billion in assets had been frozen on-chain by the time of the update. Tether froze more than 1.567 billion USDT, while Circle froze over 800 million USDC. The Arbitrum Security Council secured roughly 74.6 million ARB and 8,425 ETH associated with the attacker.

Historical Context and Attribution

TRM Labs based its high-confidence attribution on patterns matching earlier North Korean-linked incidents, including the February 2025 Bybit hack that drained about $1.5 billion. Chainalysis co-founder and CEO Jonathan Levin described TraderTraitor as the likely perpetrator and noted the operation’s estimated value at $6.4 billion at the time of the theft.

The FBI had previously linked TraderTraitor to the Bybit attack and stated that North Korean hacking operations use stolen cryptocurrency to finance weapons programs. Binance has not officially named the attacker but said it is working with authorities to confirm identities.

Market Impact and Broader Effects

Cryptocurrency markets reacted sharply to the news. Bitcoin briefly fell below $77,000 amid the revelations. Total liquidations across the derivatives market exceeded $1.5 billion in a single 24-hour period. Binance remains the largest exchange by trading volume, and the scale of the loss represents the largest known breach in the industry.

Blockchain sleuths continue tracing the remaining funds. The thief’s new wallet received the initial 17,260 ETH, and investigators are monitoring whether the attacker will attempt to launder the remaining holdings through mixers or other services. The incident has prompted renewed scrutiny of hot-wallet security practices across the crypto industry.