TRM Labs Blames North Korea for $6.36B Binance Hack

Published October 30, 2026, 09:40 AM PKT. This is a follow-up to MABOnChain's October 30 articles on Binance's investigation into a suspected multi-billion wallet drain, its pause of withdrawals, its pledge to cover all losses and suspend all deposits and withdrawals, and its first findings pointing to a compromised DevOps engineer's laptop. It is based on TRM Labs' analysis published October 30, 2026 (primary source for the attribution, the $6.36 billion total, the chain-by-chain breakdown, the EIP-7702 mechanism, the freeze figures and the attacker's remaining holdings), and on CNN, CoinDesk and Sky News reporting (secondary sources). Binance has not itself confirmed the attribution in this article's sources, and readers should keep that distinction in mind throughout.

The largest crypto theft on record now has a named suspect, according to the blockchain intelligence firm tracking the stolen funds. TRM Labs attributes the October 29 attack on Binance to TraderTraitor, North Korea's elite hacking unit, based on what TRM calls robust on and off-chain intelligence, and TRM says it makes the judgment with high confidence. The FBI named the same group as responsible for the $1.5 billion Bybit hack in February 2025, TRM notes, and the new theft, at about $6.36 billion, is roughly four times that size. CNN, citing TRM and a second tracking firm, Pangolin Intelligence, reports the same North Korea link, and CoinDesk reports that TRM, the investigator ZachXBT and the security firm Blockaid all point to North Korea as likely behind the hack. The attribution answers the question MABOnChain's previous article left open, when Binance said it was working with law enforcement to confirm the identity of the criminals and no attribution had been published. It is still an attribution by investigators, not a statement by Binance or by law enforcement about this attack, and North Korea has previously denied hacking allegations, CNN notes, adding that it has reached out to North Korea's mission at the United Nations for comment.

The attribution: TraderTraitor, with high confidence

TRM's case rests on patterns it says match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack of April 2026. The preparation, TRM says, began at least 36 hours before the theft: the attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting on the morning of October 28. Early on October 29, the operator deployed a first piece of attack code and tested it on two wallets, then rehearsed the final version on a third wallet and routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet. TRM also points to signatures obtained in advance and then executed in one burst, and to small Tornado Cash withdrawals funding an operator wallet, as signatures of earlier North Korea-linked operations. The laundering observed so far differs from the pattern after Bybit, TRM says: instead of a bridge-heavy route, the attacker moved funds through large swaps with market makers and through lending protocols. Ari Redbord, TRM's global head of policy, told Sky News the scale was extraordinary, saying few financial systems have ever shown a theft of this scale, and TRM senior investigator Nick Carlsen told The Wall Street Journal it was the largest bank heist in human history, according to syndicated reporting of those remarks. None of that is proof in a courtroom, and TRM says it will share further findings as the investigation develops, but it is the first detailed, evidence-based attribution published for this attack, and it now frames how exchanges, compliance teams and law enforcement will chase the funds.

Twenty minutes, ten chains, $6.36 billion

TRM traced every transfer from Binance-attributed wallets to attacker-controlled addresses across ten blockchains, valuing each transfer at the price of the asset at the moment it was taken, for a total of approximately $6.36 billion. At current prices the same assets are worth about $6.23 billion, TRM says. Most of it moved in about 20 minutes starting at 20:05 UTC on October 29. The first theft came on the XRP Ledger, where between 20:05 and 20:09 UTC five Binance wallets sent 233.46 million XRP, about $296 million, to a single attacker address, leaving each wallet with only its minimum balance, and that XRP has remained in place since, TRM says. Binance wallets on Solana and Optimism followed shortly after 20:10 UTC. At 20:20 UTC a Binance bitcoin hot wallet sent 18,270 bitcoin, about $1.47 billion, to an attacker address that began splitting the funds into round 1,000 bitcoin and 100 bitcoin pieces inside the same block, a technique called a peel chain that makes funds harder to follow. Within two minutes, a Binance hot wallet on Tron sent 612.7 million USDT and 46.4 million TRX, about $628 million in total, to the attacker. A second wave around 23:05 UTC reached Binance wallets on Avalanche and Polygon. Ethereum accounts for the largest share, about $3.79 billion, including 200,630 ether and 185 other tokens, among them 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD. Solana outflows total 970,500 SOL, about $96 million. Arbitrum, Optimism and Base combine to about $39 million, including 74.6 million ARB taken on Arbitrum. Avalanche outflows total about $28 million and Polygon about $10 million. Binance's own estimate of around $6.3 billion, published in its earlier update, now sits close to TRM's independently traced $6.36 billion, which narrows the uncertainty that surrounded the first hours, when outside estimates ranged from about $2.5 billion to nearly $6 billion.

The EIP-7702 sweeper and the signing system

The most technically detailed part of TRM's analysis concerns Ethereum, and it raises a question Binance's laptop account has not yet answered. EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025, lets an ordinary wallet hand control of its behavior to a smart contract by signing an authorization. At 20:20 UTC, TRM says, the operator submitted a single transaction containing 50 authorizations, each signed by the Binance hot wallet and each pointing it to a sweeper contract that accepts instructions only from the operator. A wallet keeps a running count of its transactions, called a nonce, and an authorization works only at the count the wallet has reached when it executes. Because the Binance hot wallet processes a steady flow of withdrawals, its count keeps moving, so by preparing signatures for 50 consecutive counts the attacker guaranteed that one would still be valid when the transaction executed. One matched, and that was all the attacker needed. Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address, a single transaction moving 167,464 ether and 63 tokens, including 1.615 billion USDT. The delegation stayed in place, and as new funds reached the wallet the operator swept them again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC. The wallet also served as the executor of a separate Binance smart account, which let the attacker pull 823 million USDC from it before Circle froze that USDC. CoinDesk's separate review of Binance's reserve data confirms the same wallet, labeled Binance 14, appears in Binance's October 1 proof of reserves, and reports the same 167,464 ether movement at 20:24 UTC plus 28,005.6 ether from Binance 16. TRM's broader assessment goes further: the other chains cannot be explained by the Ethereum delegation alone, because in the same window wallets on the XRP Ledger, Arbitrum, Avalanche, Optimism, Base, Bitcoin, Tron and Solana all sent funds to the attacker through standard signed transfers, using different chains, key types and signing schemes, all producing valid signatures within about half an hour. In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains. That assessment sits uneasily beside Binance's statement that a compromised DevOps engineer's laptop let an attacker reach a service container, and Binance has yet to publish a root cause that connects the two accounts. Until its post-mortem arrives, the laptop theory and the signing-system assessment are two partial explanations, not one confirmed story.

About $2.7 billion frozen, about $2.4 billion beyond reach

The freeze race is where the industry's response has worked best, and also where its limits show. Binance said at 23:35 UTC that the verified total frozen had reached $2.54 billion, and including later freezes TRM counts about $2.7 billion frozen on-chain as of 00:30 UTC on October 30. Tether froze about 1.77 billion USDT, TRM says, including 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep, with later sweeps landing in the frozen wallet, which now holds 1.175 billion USDT, plus 205 million USDT in two other attacker wallets on Ethereum, 378.7 million USDT in two attacker wallets on Tron, 8.4 million USDT on Avalanche and 6.2 million USDT0 on Polygon. Circle froze about 825 million USDC, including the 823 million USDC in the main receiving wallet at 21:04 UTC, in coordination with law enforcement, plus 1.56 million USDC the attacker had swapped from AVAX and bridged from Avalanche to Ethereum. Ripple froze the wallet holding the stolen RLUSD at 22:01 UTC, with 40.5 million of the 88.5 million RLUSD still inside, and also froze RLUSD in the compromised Binance hot wallet so new deposits could not be swept. World Liberty Financial froze 27.8 million USD1 in the main receiving wallet at 22:10 UTC and froze USD1 in the compromised hot wallet at 22:26 UTC. Arbitrum's Security Council, a group with emergency powers over the network, used those powers at 00:08 UTC to force two transfers out of the attacker's wallet on Arbitrum, moving 8,426 ether and 74.6 million ARB, about $30 million, out of the attacker's reach. Against that total stands what the attacker kept. During the first hours the attacker converted freezable stablecoins into assets no issuer can freeze, at steep cost: about 325 million USDT was sold to professional fillers and market makers through UniswapX and other intent-based contracts in exchange for about 122,300 ether, implying a price near $2,650 per ether when ether traded around $2,300 to $2,350, a discount of more than 10 percent. A second attacker wallet supplied 60 million USDT to the lending protocol Aave and borrowed about 19,760 ether against it, after which Aave froze the affected markets. With the ether consolidated in a few wallets and the 18,270 bitcoin moving through the peel chain, the attacker controls about $2.4 billion in assets beyond any issuer's reach, TRM says, plus smaller amounts on other chains. That $2.4 billion alone exceeds every previous crypto theft, including Bybit's $1.5 billion, and based on previous large thefts TRM expects the next stage to involve cross-chain bridges, swap services and over-the-counter brokers.

What has not changed: withdrawals still suspended

For Binance's customers, the practical position is unchanged. All deposits and withdrawals remain temporarily suspended while Binance conducts security checks, freezes funds and works with law enforcement, and Binance Alpha trading stays paused, with no reopening date given in any source for this article. Binance has repeated that user funds are safe and that it will cover all losses from its SAFU fund and company funds, and co-chief executive Yi He has said withdrawals will resume as soon as the security scan is complete. The attribution does not change that timetable, and it does not by itself return any funds: frozen stablecoins are stopped, not refunded, and the $2.4 billion in ether and bitcoin can only be recovered by tracing, seizure or negotiation, not by an issuer's freeze button. TRM says it is tracking the funds and alerting partners through its Beacon Network, and it urges exchanges and compliance teams to screen deposits and counterparties against the labeled attacker addresses, warning that funds from the bitcoin peel chain and the ether consolidation wallets are likely to reach exchanges, swap services and OTC desks in the coming days. Customers should also expect scam attempts built on this story: any message offering to unlock withdrawals for a fee, or asking for account details through an unofficial link, should be treated as a scam, and Binance says it will share verified updates only through official channels.

What to watch next

The next verified facts to look for are Binance's detailed technical post-mortem, which must reconcile the laptop account with TRM's signing-system assessment; Binance's updated proof-of-reserves figures; a Binance announcement reopening deposits and withdrawals; any statement from law enforcement confirming or disputing the TraderTraitor attribution; and the first confirmed movements of the $2.4 billion in ether and bitcoin through bridges, swap services or OTC brokers. Until the post-mortem arrives, the confirmed position is this: TRM Labs attributes the attack to North Korea's TraderTraitor unit with high confidence, based on on and off-chain intelligence; about $6.36 billion moved from Binance wallets across ten blockchains in about 20 minutes on October 29, 2026; about $2.7 billion has been frozen on-chain; the attacker still controls more than 420,000 ether and 18,270 bitcoin, worth about $2.4 billion, beyond any issuer's reach; Binance pledges to cover all losses from its SAFU fund and company funds; and all deposits and withdrawals remain suspended with no reopening date.

This article is news reporting and is not investment advice.

Sources

• TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (published October 30, 2026; figures as of October 30, 00:30 UTC), primary source for the TraderTraitor attribution with high confidence, the $6.36 billion total across ten blockchains, the 20-minute window starting 20:05 UTC, the chain-by-chain breakdown, the 36-hour preparation, the EIP-7702 delegation with 50 pre-signed authorizations, the repeated sweeps, the signing-infrastructure assessment, the freeze breakdown by issuer, the conversion discounts, the Aave and JustLend activity, and the attacker's remaining holdings of more than 420,000 ether and 18,270 bitcoin worth about $2.4 billion
• CNN, World's largest crypto exchange hit by world's largest heist (published October 30, 2026, 04:08 UTC), secondary source for the North Korea attribution by TRM and Pangolin Intelligence, the roughly $3 billion frozen, Binance's laptop account and coverage pledge, and North Korea's previous denials of hacking allegations
• CoinDesk, Binance loses over $6 billion in the largest crypto hack to date (updated October 29, 2026, 11:41 PM EDT), secondary source for corroboration of the North Korea link by TRM, ZachXBT and Blockaid, the roughly $3 billion frozen including $2.3 billion in USDT and USDC, and the Chainalysis $5.9 billion estimate
• CoinDesk, Binance says customer money is safe after huge hack drains key reserve wallets (published October 29, 2026, 8:17 PM EDT), secondary source for the Binance 14 wallet in Binance's October 1 proof of reserves and the Etherscan transfer figures
• Sky News, It looks like a hack: Crypto worth billions stolen from exchange (published October 30, 2026, 01:35 UTC), secondary source for TRM's Redbord remarks on the scale of the hack, the 15 to 20 minute movement window, the early North Korea link, the more than $3 billion frozen, and the attacker's remaining $2.4 billion in bitcoin and ether
• MABOnChain, Binance Points to Compromised DevOps Laptop in $6.3B Hack, No Key Leak Found (October 30, 2026), context for Binance's laptop account, its $6.3 billion estimate, its coverage pledge, the continued suspension of deposits and withdrawals, and the previously open attribution question