5BTC or 111% + 111 Free Spins!
New players only. Exclusive 111% Welcome Bonus + 111 Free Spins
Hackers stole approximately $6.36 billion from Binance on October 29, draining exchange wallets across ten blockchains, according to TRM Labs. Most of the theft occurred within about 20 minutes, with investigators examining compromised transaction-signing systems and a malicious Ethereum wallet authorization.
Good to know
The attack involved more than a single wallet. On Ethereum, the attacker used malicious code to take control of Binance 14, a hot wallet that processes regular exchange activity. Other Binance wallets sent funds through ordinary signed transactions across several networks.
Binance says its initial investigation points to a compromised DevOps engineer laptop that may have allowed access to an internal service container. The attacker could then submit unauthorized withdrawal transactions. However, the exchange has found no evidence of leaked wallet private keys.
Blockaid identified an Ethereum transaction containing 50 signed EIP-7702 authorizations targeting Binance 14.
EIP-7702 allows a wallet to authorize smart contract code to act on its behalf. The attacker supplied authorizations with consecutive transaction counters, known as nonces, so one could match the active wallet counter.
Only one authorization succeeded. That was enough to activate malicious code and allow the attacker to drain assets.
“The attacker effectively reprogrammed a major Binance Ethereum hot wallet so that a single operator could drain it, including any new money deposited into it,” Blockaid co-founder and CEO Ido Ben-Natan said.
Investigators traced approximately $2.5 billion from Binance 14, including 167,464 ETH and more than 1.6 billion USDT. Subsequent transactions also targeted funds arriving after the initial drain.
The wider pattern led TRM to suspect a compromise of the systems that authorize transactions, rather than an isolated problem affecting one Ethereum wallet.
Binance has pledged to cover losses through its SAFU fund and company resources. It also plans to publish updated Proof of Reserves after completing remediation.
Recovery efforts have involved stablecoin issuers, blockchain networks and law enforcement. Tether CEO Paolo Ardoino reported freezing more than 1.567 billion USDT, while Circle CEO Jeremy Allaire confirmed freezing over 800 million USDC.
The Arbitrum Security Council also secured approximately 74.6 million ARB and 8,426 ETH. Binance subsequently reported roughly $3 billion in frozen assets overall. Freezing restricts further transfers but does not mean the exchange has already recovered the money.
Meanwhile, the attacker tried to convert assets before companies could block them. Bitquery estimates that approximately $729 million in stablecoins became ETH and TRX before freezes took effect.
Those conversions complicate recovery because native assets such as ETH and Bitcoin lack the issuer-controlled freezing functions available for certain stablecoins.
TRM Labs attributes the Binance attack to TraderTraitor, a North Korean hacking unit associated with Lazarus Group, with high confidence. Its assessment draws on blockchain activity and other intelligence, although the firm has not published all supporting evidence.
Blockchain investigator ZachXBT separately identified Lazarus as the likely attacker. Binance has not confirmed that attribution.
TRM traced preparations beginning at least 36 hours before the theft, including small Tornado Cash withdrawals into an attacker-controlled wallet and tests of malicious code.
The investigation also identified 233.46 million XRP, worth nearly $296 million, leaving five Binance wallets before the Ethereum attack began.
The FBI previously attributed the approximately $1.5 billion Bybit theft in February 2025 to TraderTraitor. The estimated Binance theft exceeds that amount by more than four times. Following the Bybit attack, investigators tracked conversions into Bitcoin and transfers across thousands of addresses.
Binance initially suspended deposits and withdrawals while conducting security checks. A separate update said deposits were operating normally, while withdrawals remained paused during changes to withdrawal services and related addresses.
The exchange said it expected withdrawals to resume within 48 hours. That timetable remains an estimate, rather than confirmation that services have restarted.
Binance has revoked affected address authorization and plans to publish a detailed technical report once investigators establish the full attack path.