On October 29, 2026, funds began leaving Binance hot wallets across several blockchains. Binance puts the affected assets at $6.3 billion, while Chainalysis estimates unauthorized transfers at $6.4 billion, making it the largest crypto theft on record. Investigators now point to TraderTraitor, a group linked to North Korea.
🔑 Key takeaways
- Binance estimates $6.3 billion in affected assets; Chainalysis puts unauthorized transfers at $6.4 billion.
- Transfers started around 4:20 p.m. ET, and coordinated freezes began at 5:14 p.m. ET.
- Chainalysis attributes the attack to TraderTraitor, also known as Lazarus Group, based on fund flows that overlap with the September Bitget hack.
- Binance says it will cover all losses, and withdrawals remain disabled until the environment is confirmed secure.
A more complex attack path than a simple key leak
On Ethereum, the attacker used an operational wallet funded through Tornado Cash to submit valid signed authorizations. These allowed a Binance hot wallet to execute code deployed by the attacker. Other affected wallets reportedly made ordinary signed transfers. This distinction matters: since cryptocurrencies are controlled by private keys, a platform compromise does not necessarily mean those keys were leaked. Binance says it has so far found no evidence of a wallet private key leak.
The investigation first pointed researchers to a compromised laptop belonging to an engineer. Co-CEO Richard Teng explained that this gave the attacker access to a “service container”, where unauthorized withdrawal transactions were submitted. Binance later said other entry points had been discovered, without providing details. Co-CEO Yi He posted on X that security came first, with withdrawals paused until the environment was confirmed safe.
“To be clear: the attacker did not simply use an engineer’s permissions, and this was not a one-click, single action. It was a more complex attack process. Our investigation has not attributed responsibility to any individual.”
Richard Teng, Co-CEO, Binance
That account shows why early assumptions of a single compromised individual were revised: the attack relied on a chain of operations rather than one access point.
Timeline and rapid stablecoin conversion
The attacker tried to quickly convert stablecoins, which their issuers can freeze, into assets such as ETH, which cannot be frozen directly at that level. The attacker first moved $500 million in stablecoins to a wallet set up to swap them. Within nearly 20 minutes, $325 million was converted into $285 million worth of ETH. Ten minutes later, the remaining $175 million was sent to transit wallets, likely to slow down blocklisting efforts.
| Step | Timing | Amount |
|---|---|---|
| Unauthorized transfers begin | 4:20 p.m. ET | Not specified |
| Initial transfer to a swap wallet | Not specified | $500M |
| Stablecoins swapped for ETH | About 20 minutes | $325M converted into $285M of ETH |
| Remaining balance sent to transit wallets | About 10 minutes later | $175M |
| Coordinated freezes begin | 5:14 p.m. ET | Not specified |
Chainalysis investigators observed thousands of transactions in a short period. Many addresses first received exactly 1 TRX, then additional funds, before forwarding them to other addresses. These sequences, together with repeated circulation of funds between previously used addresses, suggest an automated process designed to obscure the trail. BFMTV says most of the theft occurred within about twenty minutes, while Chainalysis places the start of transfers at 4:20 p.m. ET; sources do not all use the same time markers.
Attribution to TraderTraitor and fund freezes
Chainalysis attributes the theft to TraderTraitor, a North Korean cybercrime group that targets platforms, decentralized protocols and investors to fund the regime. The assessment relies in part on real-time observation of stolen Binance funds overlapping with proceeds from the Bitget hack in September 2026, which cost $388 million. Chainalysis announced its conclusion on October 30 at 12:30 a.m. ET. TRM Labs and Elliptic also pointed to TraderTraitor or Lazarus Group. TRM Labs noted several similarities with the $1.5 billion Bybit theft in February 2025, which the FBI says was four times smaller than the Binance incident.
“This means attackers no longer need the keys to the vault. They target the systems and the people authorized to use them.”
Jayant Dave, Chief Information Security Officer, Check Point
Binance has not directly confirmed a North Korean link. It says it is working closely with law enforcement partners to confirm the identity of those responsible. Western agencies reportedly say stolen funds linked to North Korean operatives help finance the country’s nuclear and missile programs; the regime denies any involvement.
Frozen-fund figures do not line up
- Tether and Circle together announced about $2.4 billion frozen.
- Chainalysis cited about $2.8 billion frozen in its publication.
- BFMTV reported about $3 billion frozen and $3.3 billion still in the hackers’ hands.
The sources do not clarify whether these gaps reflect different calculation dates or different tracking scopes. A freeze also does not mean funds have been recovered. World Liberty Financial says it cooperated with partners to immobilize stolen funds. Coinbase says it is unaffected and is monitoring the situation, while Binance.US says its platform is not involved. In the hours before Binance’s official confirmation, several market observers had flagged concerns: bitcoin fell by more than 4%, and ether and solana also declined sharply.
Chainalysis hit by its own intrusion, and Binance’s background
In the middle of the tracing effort, Chainalysis disclosed that it had suffered a cyberattack. The intrusion was detected in October, and a four-sentence statement was published on Friday at 10:14 p.m. Paris time. The company described the incident as “similar to that of many other tech platforms in recent weeks” and said the attacker used “offensive agentic techniques”, meaning AI agents. Chainalysis says it found no evidence of access to investigation content, authentication credentials or session tokens, and it does not link the incident to the Binance theft.
Excerpts of the customer email, published by Blockchain.News, indicate that the intruder accessed user IDs, full names, email addresses and job titles within client organizations. Chainalysis calls this data “non-sensitive”. The attacker reportedly did not access investigation graphs, notes, case files, query results, plaintext passwords or two-factor authentication secrets. The number of affected clients has not been disclosed. Journal du Coin notes that such a list could facilitate targeted phishing, and a 2022 CISA alert states that TraderTraitor has previously used fake job offers aimed at crypto-sector employees.
Binance was founded in China in 2017 and claims 335 million users, while the BBC cites more than 300 million registered accounts. The company reported more than $160 billion in assets under custody in 2024. Its former CEO Changpeng Zhao was convicted in the United States in April 2024 for violating anti-money laundering law, then pardoned by Donald Trump the previous year. The exchange is under investigation in France over customer fund controls, and it partially suspended its European Union activities this summer for lack of MiCA authorization.
“Even when you think you are on one of the most robust platforms in the world, it can be hacked.”
Stéphane Ifrah, Analyst, Coinhouse
This view echoes TRM Labs’ Ari Redbord, who called the case a pivotal moment for the industry while noting that the attacker still holds a considerable sum. Tracing and recovery therefore remain far from complete.
Outlook and scenarios
Three scenarios emerge in the short term. The most favorable depends on continued freezes and coordination among exchanges, stablecoin issuers and authorities, which could allow partial recovery of immobilized funds. The second is a long tracing process: converted ETH, funds spread across transit addresses and potential mixing through dedicated services or offshore partners would remain hard to recover. The third concerns structural effects: heightened platform vigilance, regulatory pressure on custody standards and the hardening of both human and software access controls are likely to become sector priorities.
For market participants, the central lesson is that platform security cannot be reduced to protecting private keys. Attacks now target internal systems, authorized personnel and automated tools. Final figures for freezes, recoveries and compensation remain to be confirmed.
Sources
- Journal du Coin
- Google News (redirect link)
- Chainalysis, Binance exploit: latest findings and response
- BFMTV
- BBC News
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
