North Korea is behind the Binance hack of 29 October 2026, according to two leading blockchain investigators. TRM Labs attributes the attack with high confidence to TraderTraitor, a North Kor
North Korea is behind the Binance hack of 29 October 2026, according to two leading blockchain investigators. TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group, and Chainalysis also sees the same group as the likely perpetrator. Binance itself has not named an attacker. It puts the damage at around $6.3 billion and, according to its announcement on X, expects to reopen withdrawals within 48 hours, by Sunday morning at the latest. Here is everything known so far about the largest crypto theft in history.
Binance hack: the key facts
How the evening played out in the market is in our timeline with live ticker, the first report in our Binance hack story.
TRM Labs bases the attribution on its own on-chain data and intelligence from outside the blockchain. The pattern matches two earlier attacks: the $1.5 billion hack of the exchange Bybit in February 2025, which the FBI attributed to TraderTraitor, and the attack on KelpDAO in April 2026. In all three cases the attacker's wallet was funded in advance through the mixer Tornado Cash, and the required signatures had been collected before any money moved.
Chainalysis CEO Jonathan Levin also considers TraderTraitor the likely perpetrator. According to SecurityWeek, his investigators found proceeds from last month's Bitget exploit mixed with the Binance loot. Binance says it is working with law enforcement but has not named an attacker, and no authority has made an official attribution yet.
TraderTraitor is a subgroup of the North Korean hacking network widely known as Lazarus. It targets employees of crypto companies, often through rigged job offers or trading apps, to gain access to internal systems. That fits what Binance says about how the attacker got in.
According to Binance's official announcement, a DevOps engineer's laptop was compromised. Through it, the attacker reached a service container and submitted unauthorized withdrawals. Binance found no evidence of a private key leak. TRM Labs goes further: because wallets on ten blockchains were emptied in the same window with ordinary, validly signed transfers, the attacker apparently made the hot wallet signing system itself work for him. A single stolen key or a phishing page does not explain that.
On Ethereum he used the EIP-7702 feature. In our own on-chain analysis we checked the decisive transaction: 50 pre-signed authorizations for the hot wallet “Binance 14”, one for each possible transaction number, so that one would hit. That preparation suggests his access to the signing system was limited in time.
Source: TRM Labs, as of 30 October 2026
Blockchain
Drained according to TRM Labs
Ethereum
$3.79B (200,630 ETH and 185 other tokens)
Bitcoin
$1.47B (18,270 BTC)
Tron
$628M (612.7M USDT, 46.4M TRX)
XRP Ledger
$296M (233.46M XRP)
Solana
$96M (970,500 SOL)
Arbitrum, Optimism, Base
$39M
Avalanche
$28M
Polygon
$10M
Total
about $6.36B
About $2.7 billion is frozen according to TRM Labs; Binance itself speaks of about $3 billion. Most of it was blocked by the stablecoin issuers: Tether froze about 1.77 billion USDT, Circle about 825 million USDC. How we counted the freezes ourselves is in USDT frozen. Ripple added 40.5 million RLUSD, World Liberty Financial 27.8 million USD1, and the Arbitrum Security Council pulled about $30 million in ETH and ARB out of the attacker's wallet at 00:08 UTC.
Source: TRM Labs, as of 30 October 2026
Beyond the issuers' reach are more than 420,000 ETH and 18,270 BTC, together about $2.4 billion. The attacker used the time before the freezes: he swapped about 325 million USDT into roughly 122,300 ETH through UniswapX and similar services at a discount of more than 10 percent, supplied 60 million USDT to Aave to borrow about 19,760 ETH, and moved 300 million USDT on Tron into the lending protocol JustLend. The bitcoin is being split into chunks of 1,000 and 100 BTC to blur the trail. Unlike after Bybit, the group is relying less on cross-chain bridges this time and more on large swaps and lending protocols.
Deposits are working normally, Binance says. Withdrawals remain paused while the exchange completes a security revamp of the withdrawal service and its related addresses. At 04:36 UTC Binance said it expects to resume them within 48 hours, which would be Sunday, 1 November, around 04:36 UTC at the latest. Binance has not said whether all coins will reopen at once or step by step. Which networks were paused before the full halt is in our story on Binance withdrawals.
Service Update. Deposits remain unaffected and continue to operate as normal. Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours, and will update with further details.
Binance (@binance) October 30, 2026
Yes, according to its own pledge. Binance will cover all losses from its SAFU emergency fund and company funds. Whether the exchange can absorb the damage is what we calculate in How much would it take to bankrupt Binance?. Binance plans to publish an updated proof of reserves once the security work is complete.
If you do not want to keep larger amounts on an exchange, you can hold them yourself, for example in a hardware wallet, or spread your funds across regulated crypto exchanges.
On Friday at 10:30 UTC Bitcoin traded at $77,296 according to CoinMarketCap, 3.4 percent lower than 24 hours earlier. BNB lost 5.4 percent to $700.66, Ether 3.9 percent to $2,226 and Solana 3.5 percent to $96.51. Measured against the size of the theft, that is a restrained decline, put into context in Bitcoin price after the Binance hack. The North Korea trail has a sober consequence for the market: state hackers do not hold on to their loot, they convert it in tranches over weeks. The more than 420,000 ETH held by the attacker are therefore what traders are watching most closely.
Our view: for Binance customers the question of who did it changes little. Two dates matter: whether withdrawals really resume by Sunday, and whether the announced proof of reserves shows full coverage. If both happen, pressure on BNB and the market should ease. If either slips, a security incident turns into a question of trust.
