Binance Hack: $6.3 Billion Security Breach, Frozen Funds and Suspected North Korea Link
Binance says a security incident affected about $6.3 billion, with roughly $3 billion frozen. TRM Labs traced outflows across 10 chains and suspects North Korea-linked hackers.
On this page
Binance said a security breach affected approximately $6.3 billion on 30 October 2026. Attackers had made unauthorized withdrawals from exchange-controlled wallets. Binance said roughly $3 billion had been frozen on-chain. It pledged to cover losses using its SAFU fund and company funds.
TRM Labs traced roughly $6.36 billion leaving Binance-attributed wallets across ten blockchains. Most transfers occurred within about 20 minutes on 29 October, it said.
Binance suspects a DevOps engineer's laptop was compromised. TRM Labs attributes the attack to North Korea-linked TraderTraitor hackers with high confidence. Binance has not confirmed the attackers' identity or issued a final technical finding.
What happened in the Binance hack?
The attack began on 29 October, according to blockchain analysis published by TRM Labs. The firm traced transfers across ten networks. They included Bitcoin, Ethereum, Tron, Solana and the XRP Ledger. Arbitrum, Avalanche, Optimism, Base and Polygon were also affected.
Binance initially acknowledged reports of a possible breach. It later confirmed an incident. It suspended deposits and withdrawals for security checks. It also revoked the affected address authorization. Binance said it was working with law enforcement and blockchain intelligence firms.
The $6.3 billion estimate does not mean every dollar is permanently lost. Binance has not established a final root cause. The final recovery figure is still unknown. So are Binance's net costs and the full timetable for restoring services.
Binance hack in numbers: what is confirmed?
| Measure | Figure | Reporting source |
|---|---|---|
| Estimated incident impact | Approximately $6.3 billion | Binance, 30 October |
| Outflows traced by TRM Labs | About $6.36 billion at transfer-time prices | TRM Labs |
| Assets frozen on-chain | About $3 billion | Binance, 30 October |
| Blockchains affected | 10 | TRM Labs |
| Attacker-held assets outside freezes | About $2.4 billion at TRM's assessment time | TRM Labs |
Do not add these figures together. Binance estimates the incident's total impact. TRM measures traced transfers at the time of each transaction. A freeze stops certain assets from moving. It does not mean Binance has recovered those assets.
TRM verified about $2.7 billion in freezes by 00:30 UTC on 30 October. Binance later reported roughly $3 billion frozen. These figures reflect different reporting times and methods.
How did attackers gain access to Binance wallets?
Binance said its initial investigation suggests attackers accessed a service container through a compromised engineer's laptop. They then submitted unauthorized withdrawals. Binance said it found no evidence that wallet private keys had leaked.
This explanation remains preliminary. Binance has promised a technical post-mortem. The exact failure chain is still unknown.
TRM's on-chain reconstruction points to a wider compromise of transaction authorization. Wallets on several networks generated valid signatures in quick succession, TRM said. They used different signing schemes.
What role did Ethereum's EIP-7702 play?
TRM says the attacker submitted 50 pre-signed EIP-7702 authorizations on Ethereum. One valid authorization delegated a Binance hot wallet to an attacker-controlled contract. That contract could move funds and sweep later deposits.
EIP-7702 lets an Ethereum account delegate execution to smart-contract code. A valid authorization does not explain how the attacker obtained its signature.
Other affected blockchains do not use EIP-7702. TRM therefore suspects a wider compromise of signing infrastructure. However, Binance has not published its final root-cause assessment.
Who is suspected of carrying out the attack?
TRM Labs attributes the incident to TraderTraitor, a North Korea-linked hacking group. TRM cites additional intelligence and similarities to earlier attacks.
This remains an attribution by a private blockchain intelligence firm. Binance is working with law enforcement to identify the attackers. The company did not name TraderTraitor in its 30 October announcement.
TRM also linked TraderTraitor to Bybit's February 2025 breach. That attack involved roughly $1.5 billion. TRM's Binance outflow estimate is more than four times larger. It could be the biggest recorded crypto theft. Final losses and recoveries remain uncertain.
How much cryptocurrency was frozen, and who helped?
Binance said on 30 October that industry partners had helped freeze around $3 billion of affected assets on-chain.
TRM identified freezes by Tether, Circle, Ripple and World Liberty Financial. Arbitrum's Security Council also intervened. TRM valued the freezes at about $2.7 billion at the time. Different reporting cutoffs explain the varying totals.
A freeze can stop certain stablecoins from moving. It does not guarantee a refund. Attackers may still control unfrozen Bitcoin and ether. Recovery often requires cooperation among issuers, networks, exchanges and investigators.
TRM reported attempts to convert stablecoins into ether. It also traced Bitcoin through several addresses. Holdings and valuations may change as investigators follow the funds.
Are Binance customer funds safe?
Binance said that user funds were safe and that it would cover all losses using SAFU and company funds. This is Binance's commitment. It is not independent proof that all customers can immediately withdraw their balances.
Binance temporarily suspended deposits and withdrawals during security checks. A visible balance therefore did not guarantee immediate access to funds.
Binance pledged an updated proof-of-reserves report. Such reports can help customers assess exchange assets. But readers should check their scope, liabilities and verification methods. Finlazo's guide to checking crypto exchange proof of reserves explains what such reports do and do not establish.
Customers should follow Binance's official updates and review their account records. Ignore messages demanding recovery fees or transfers to new addresses. Unsolicited recovery links may be fraudulent.
Why the Binance breach matters for crypto exchanges
The breach raises questions about shared signing systems and hot-wallet approvals. It also tests whether safeguards operate independently across networks. Token issuers and other participants quickly froze some affected assets.
Exchanges have different security controls. Customers should assess custody, withdrawal protections and recovery policies. Operational transparency matters too. Finlazo's crypto exchange directory helps readers compare providers, while its closed exchange directory documents earlier failures and their consequences for customers.
What happens next?
Three updates matter most. First is Binance's technical post-mortem. Second is the revised proof-of-reserves report. Third is evidence of recovered funds. New forensic findings may also clarify who carried out the attack.
Reporting status: 30 October 2026. This article draws on Binance's initial statement and TRM's early on-chain analysis. The investigation remains open. Freeze totals, asset values and service restrictions may change.
