Binance’s $6.3B Exodus Has a Twist in the Plot—and a North Korea Tail 🧩

Binance estimated that a security incident involving unauthorized withdrawals affected approximately $6.3 billion in crypto assets, making it the largest suspected crypto theft on record if confirmed. The exchange said on October 30, 2026, that its initial investigation indicated a compromised DevOps engineer’s laptop may have provided access to a service container capable of submitting unauthorized withdrawal transactions, but a later review found “additional points of breach” and described the incident as a complex attack.

The suspected outflows began on October 29 and spanned nine blockchains, according to blockchain analytics firm Arkham, which valued the assets taken from Binance hot wallets at $6.01 billion between 4:10 p.m. and 7:05 p.m. ET. Earlier on-chain estimates placed the total near $5.57 billion across Ethereum, Bitcoin and Tron, including $3.51 billion on Ethereum, $1.44 billion in 18,270 Bitcoin and $630 million on Tron. Another analysis detected approximately $5.643 billion by 21:22 UTC, comprising $3.528 billion from Ethereum, $1.449 billion from Bitcoin, $628 million from Tron and about $38 million from Arbitrum, Optimism and Base.

Blockchain records showed that one Binance-labeled Ethereum wallet transferred 167,464 ETH and 63 tokens, including 1.615 billion USDT, to a newly created address at 20:24 UTC. Binance 16 sent another 28,005 ETH to the same address 24 seconds later, while the receiving address forwarded 195,460 ETH to another fresh address within 15 minutes. The transaction followed an EIP-7702 delegation submitted three minutes earlier by an address funded through Tornado Cash, a crypto mixing service. The method for obtaining the required signature remains unknown, and Binance said it had found “no evidence of any wallet private key leak.”

Tether and Circle initially froze approximately $971 million in USDT and $823 million in USDC, respectively, bringing the stablecoin total to nearly $1.8 billion. Circle CEO Jeremy Allaire said, “Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.” Binance later said approximately $3 billion of affected assets had been frozen onchain with help from blockchain partners, while Arkham reported that issuers had frozen $2.80 billion. Changpeng Zhao, who no longer manages Binance, wrote, “It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).”

TRM Labs, Chainalysis and onchain investigator ZachXBT linked the attack to North Korea’s TraderTraitor group. TRM Labs expressed “high confidence” in that attribution, while Chainalysis co-founder and CEO Jonathan Levin said the group was likely responsible for the theft. ZachXBT identified that funds from Binance and the earlier Bitget exploit were commingled at the same address after moving through THORChain. Binance paused withdrawals and revoked the affected address authorization, while deposits returned to normal. The exchange said it would cover all losses through its SAFU fund and company funds, and that withdrawals were on track to resume within 45 hours after a security revamp.