Astana, 30 October. The attack on the Binance crypto exchange on 29 October became the largest theft in crypto history: about 6.36 billion dollars left the exchange’s accounts on ten blockchains, most of it in about 20 minutes from 20:05 GMT, and North Korea’s TraderTraitor hacking unit has been named the perpetrator with high confidence, according to research by the analytics firm TRM Labs.
Binance reported a hack of 6.3 billion dollars and pledged to cover customers’ losses; according to the exchange’s preliminary version, the attackers gained access to internal infrastructure through the compromised laptop of one of its engineers. TRM Labs describes the mechanics: on Ethereum the attacker used an EIP-7702 delegation to turn a Binance “hot” wallet into a sweeper it controlled, with 50 pre-signed authorisations prepared in advance; on the other nine networks the exchange’s wallets sent the money through ordinary signed transfers. In TRM’s assessment, this points to a compromise of the hot wallet signing system.
Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze about 2.67 billion dollars, and the Arbitrum Security Council froze another 8,426 ETH and 74.6 million ARB, about 2.7 billion dollars in all. The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC — about 2.4 billion dollars that no issuer can block. The North Korean link is also confirmed by Singapore’s Pangolin Intelligence. Binance expects to resume withdrawals within 48 hours.
What it means: The morning damage estimates have doubled: this was not a glitch or the hack of a single wallet but an attack on the transfer-signing system of the world’s largest exchange, and almost half of the stolen funds can no longer be recovered.
What we know now: Binance promises to cover all customer losses and resume withdrawals within two days; about 2.7 billion dollars has been frozen and about 2.4 billion is with the attacker. A Binance platform has operated in Kazakhstan in the AIFC since July 2023; the exchange has not said whether its customers were affected.
Background: The previous record was about 1.5 billion dollars stolen from the Bybit exchange in February 2025; the new hack is about four times larger. The FBI also attributed that attack to the TraderTraitor group, also known as Lazarus. The exchange’s BNB token became the first asset of the state Alem Crypto Fund in 2025.
We have also reported that Binance halted withdrawals after more than 3 billion dollars flowed out.
