Binance heist: FBI links North Korea's TraderTraitor to the largest crypto theft on record
On the evening of October 29, 2026, unauthorized withdrawals began emptying Binance's hot wallets across eleven blockchains in a matter of hours. Estimates range from about 6.3 billion dollars, the exchange's own figure, to 6.43 billion, where Elliptic's on-chain accounting settled after days of counting — almost certainly the largest single theft of any kind in history, per the analytics firm. Withdrawals were suspended the same night, and the exchange spent the days that followed reassuring its roughly 335 million registered users.
The numbers behind a record theft
The scale has few precedents to lean on. The take is more than four times the 1.46 billion dollars stolen from Bybit in February 2025, then the record itself, and more than six times the roughly 1 billion dollars Saddam Hussein extracted from Iraq's central bank in 2003, as Elliptic's comparison puts it. Working from the FBI's accounting, The Hacker News counts eleven blockchains touched, with 82 percent of the value on Ethereum and Bitcoin. The largest slice sat on Ethereum: about 3.8 billion dollars across 186 tokens, alongside 18,270 BTC worth roughly 1.48 billion dollars.North Korea, with high confidence
On October 31, the FBI formally attributed the theft to TraderTraitor, a North Korea-aligned cluster also tracked as Jade Sleet and Slow Pisces, working alongside the US Secret Service and IRS Criminal Investigation. The same actors are linked to the Bybit and DMM Bitcoin heists and to smaller incidents at KelpDAO and Bitget. Private analysts pointed the same way within hours: the sleuth ZachXBT called the attacker "likely Lazarus", and TRM Labs published a "high confidence" assessment that TraderTraitor was responsible — a unit CoinDesk describes as a subcluster of Lazarus Group."We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%." — Binance co-CEO Richard Teng, October 31, 2026Binance paused withdrawals and then committed to covering every customer loss in full. The company set aside about 6.34 billion dollars of its own funds — drawn on its 1 billion dollar Secure Asset Fund for Users, its futures insurance fund and its corporate treasury, according to NBC News — with the remaining ten percent mostly in less liquid tokens that will take longer to buy back. Withdrawals came back in phases from 06:00 UTC on November 1, and the feared bank run stayed contained. The Block counted about 3.64 billion dollars in net outflows over the first nine and a half hours — roughly 2 percent of assets under management — and quoted the exchange saying volumes had "stabilised as expected" after the initial spike, deposits remaining substantial. Bitcoin had already slipped 5 percent to a six-week low of 77,380 dollars, Guardian reporting shows.
How the wallets were emptied
Binance's first public read traced the entry point to a compromised DevOps engineer's laptop; the company later described a complex attack with additional points of breach and malware built to delete evidence. Elliptic's reconstruction shows the attacker abusing EIP-7702 delegation, a feature from Ethereum's 2025 Pectra upgrade: a single transaction carrying fifty validly signed authorizations delegated control of the wallet labeled "Binance 14" to a sweeper contract, which drained it of 167,464 ETH and 63 tokens three and a half minutes later. The funds moved through Binance's own signing infrastructure rather than stolen private keys — in Elliptic's words, the infrastructure and people around the wallets were compromised, not the cryptography.The laundering track
The FBI has mapped its expectations in advance. Having watched the attacker convert stolen assets primarily into Ethereum, the bureau anticipates the funds will be laundered further through DeFi and instant swap services, and it has published the wallet addresses for services to screen against. The on-chain record so far matches the playbook: stablecoins swapped for ETH and TRX at losses of 12 to 26 percent, speed prioritized over value; 59.9 million USDT parked in Aave to borrow ETH against it; TRX shuttled through at least six different bridges.- About 2.85 billion dollars had been frozen or seized on-chain within days — 44 percent of the theft, almost all of it stablecoins, per Elliptic; Binance's own estimate is around 3 billion.
- Nothing was frozen on Bitcoin, the XRP Ledger, Solana or NEAR, leaving the attacker with roughly 3.25 billion dollars in unfreezable assets spread over more than 800 addresses.
- Elliptic has published a free blocklist of more than 8,000 linked addresses for exchanges and wallet providers.
- North Korea-linked actors are believed to have stolen more than 6.5 billion dollars in crypto over recent years, and Elliptic notes this incident almost doubles that total.