North Korea-linked attackers drained approximately $6.36 billion from Binance wallets across ten blockchains in roughly 20 minutes on October 29, 2026, marking the largest cryptocurrency theft on record and pushing the regime’s cumulative haul since 2017 to about $12.8 billion.
Blockchain analytics firm TRM Labs attributes the incident to TraderTraitor, an elite North Korean state-sponsored unit, with high confidence based on on-chain patterns and supporting intelligence.
The bulk of the funds left Binance wallets beginning at 20:05 UTC. Ethereum accounted for the largest share (roughly $3.79 billion), followed by Bitcoin (about $1.47 billion), Tron, the XRP Ledger, Solana, and several others.
The speed and coordination echoed prior North Korean operations, including the February 2025 Bybit exchange theft of approximately $1.5 billion.
Binance confirmed a security incident, suspended withdrawals on multiple networks, and stated that user funds remain safe.
The exchange indicated it would cover losses from company resources, including its Secure Asset Fund for Users.
Initial assessments pointed to compromise of hot-wallet signing infrastructure—potentially via an engineer’s laptop—rather than leakage of private keys.
On Ethereum, attackers used an EIP-7702 authorization to convert a Binance hot wallet into a controlled sweeper with pre-signed authorizations prepared in advance.
Across other chains, ordinary signed transfers emptied wallets in the same narrow window.
Roughly $2.7 billion in stablecoins and related assets was frozen by issuers such as Tether and Circle, plus action by the Arbitrum Security Council.
The attacker retained control of more than 420,000 ETH and about 18,270 BTC, valued near $2.4 billion and beyond issuer freeze capabilities.
This single event accounts for most of the $7.4 billion TRM attributes to North Korea in 2026 alone—more than half of the $12.8 billion total across roughly 100 incidents since 2017.
North Korea’s share of global crypto-hack value has climbed sharply: 7 percent in 2020, 63 percent in 2025, and 85 percent year-to-date in 2026 (falling to about 45 percent if the Binance case is excluded).
Five major infrastructure compromises—Binance, Bybit, the 2022 Ronin bridge, Bitget (around $387 million in September 2026), and DMM Bitcoin—represent approximately $9.1 billion of the cumulative total.
Unlike many other attackers who exploit smart contract bugs, North Korean groups overwhelmingly target people and the systems that control keys.
Common tactics include fake recruiters delivering malware through coding tests, prolonged social engineering of employees, and compromise of signing infrastructure or administrative access.
Only a small fraction of attributed incidents are pure code exploits, yet they yield the vast majority of value stolen.
Proceeds have historically funded the regime’s weapons programs, including nuclear and ballistic-missile development, according to U.S. officials and prior analyses.
Laundering typically involves rapid splitting of funds, cross-chain swaps, mixers, and sales through over-the-counter brokers or decentralized venues, often racing against freezes.
In the Binance case, attackers sold stablecoins at a discount to market makers and borrowed against collateral before freezes took full effect.
Preparation for the attack, including small mixer withdrawals, began at least 36 hours earlier—patterns matching the Bybit and earlier 2026 KelpDAO incidents.
The episode underscores the maturation of North Korean cyber operations into a primary revenue stream.
While exchanges and stablecoin issuers can freeze some assets quickly, native cryptocurrencies and converted holdings remain difficult to recover once they leave controlled addresses.
Binance’s scale made it a high-value target; the response illustrates both the industry’s growing ability to coordinate freezes and the persistent challenge posed by sophisticated, state-backed adversaries focused on infrastructure and human access rather than code alone.
