North Korea's TraderTraitor Suspected Behind $6.3 Billion Binance Raid
The world's largest crypto exchange just got cleaned out to the tune of $6.3 billion, and all signs point to North Korea.
Blockchain intelligence firm TRM Labs tracked roughly $6.36 billion leaving Binance wallets across ten separate blockchains on October 29. Nearly all of it was gone within 20 minutes. That makes this the largest crypto theft on record, comfortably eclipsing the $1.5 billion Bybit raid from February 2025.
Binance has suspended withdrawals and says it will cover losses through company funds and its Secure Asset Fund for Users (SAFU).
The exchange's early investigation points to a compromised DevOps engineer's laptop as the entry point, giving the attacker access to a service container from which unauthorised withdrawal transactions were submitted. Binance says there is no evidence of any private key leak.
A well-rehearsed operation
This was not impulsive. TRM's analysis shows the attackers spent at least 36 hours setting up. The operator wallet was seeded with small Tornado Cash withdrawals, and the malicious code was tested on separate wallets before being deployed.
On Ethereum, the attackers exploited EIP-7702, a mechanism that lets a standard wallet delegate control to a smart contract through a signed authorisation. The attackers sent a batch of 50 pre-signed permissions, banking on one matching the target wallet's transaction count at execution time. It worked. The Binance hot wallet ended up under attacker-controlled contract authority, and was drained accordingly.
Ethereum alone might have looked like a phishing result. But there were nine other blockchains involved, each using different key types and signing schemes, all producing valid signatures for the attacker within roughly half an hour.
TRM's conclusion: the attacker somehow gained the ability to instruct Binance's hot wallet signing infrastructure to sign transactions of their choosing, across chains.
Fingers pointing to Pyongyang
TRM attributes the attack with high confidence to TraderTraitor, North Korea's state-sponsored hacking unit. The reasoning rests on both on-chain and off-chain intelligence, combined with clear operational similarities to prior TraderTraitor jobs including the Bybit theft and the April 2026 KelpDAO hack. The shared hallmarks include mixer-funded operator wallets, extended pre-attack preparation periods, and pre-collected signatures deployed in a coordinated burst.
Chainalysis CEO Jonathan Levin also backs the TraderTraitor theory, with his firm finding overlap between funds from last month's Bitget exploit and money taken in the Binance raid. Independent blockchain investigator ZachXBT named Lazarus Group, TraderTraitor's other commonly used moniker, as the likely culprit.
The FBI previously attributed the Bybit theft to the same group. Binance itself has not named anyone, saying it is working with law enforcement.
This time around the laundering playbook looks different. Rather than funnelling funds through cross-chain bridges as in the Bybit case, the hackers have leaned on large over-the-counter trades with market makers and on lending platforms.
Frozen and unfrozen
Stablecoin issuers moved fast. By 00:30 UTC on October 30, TRM counted around $2.7 billion in frozen assets: roughly 1.77 billion USDT locked by Tether, about 825 million USDC frozen by Circle, with Ripple and World Liberty Financial accounting for smaller amounts. Arbitrum's Security Council used emergency powers to pull around $30 million out of an attacker-controlled wallet. Binance puts the total frozen figure at approximately $3 billion.
The attackers, apparently anticipating the freezes, dumped USDT for ETH at over 10% below market rate to get clear of issuer reach. TRM estimates they still hold more than 420,000 ETH and 18,270 BTC, around $2.4 billion in assets that no stablecoin issuer can touch.