TRM Labs, a blockchain intelligence firm, says North Korean hackers stole $6.36 billion in cryptocurrency from Binance. The attack reportedly hit on October 29 and drained funds across 10 different blockchains in about 20 minutes. TRM links the operation to TraderTraitor, a hacking group backed by the North Korean state.
How did TraderTraitor steal $6.3 billion from Binance?
On Ethereum, the hackers abused Ethereum’s EIP-7702 standard to take over a Binance hot wallet and turn it into a contract they fully controlled. They had prepared 50 authorizations in advance, and one of them happened to match the wallet’s transaction count.
On the other nine blockchains, they simply moved funds with ordinary signed transfers. TRM believes Binance’s wallet signing system was likely compromised, though Binance has not confirmed how the breach happened.
You may also like: How Generative AI Turned Fraud Into a $400 Billion Global Industry
The group reportedly began preparing at least 36 hours earlier. It ran test transactions and funded an operator wallet through small withdrawals from Tornado Cash. TRM Labs says TraderTraitor is also tied to last year’s $1.5 billion Bybit hack, which makes this attack about four times larger.
The stolen assets included Bitcoin, Ethereum, XRP, Solana, and stablecoins. Binance confirmed the security incident and temporarily suspended withdrawals across several networks. It said user funds are safe, though the investigation is still ongoing.
How much of the stolen cryptocurrency has been recovered from the hackers?
Companies like Tether, Circle, Ripple, and World Liberty Financial moved quickly and froze about $2.7 billion of the stolen funds. That is the good news. The bad news is that the hackers still hold around $2.4 billion in assets, including more than 420,000 ETH and over 18,000 bitcoin, and nobody can reach them for now.
You may also like: Google Sues AI-Powered Scam Network Behind $1.9B Fraud
The laundering has already started. The hackers are selling tokens that are likely to be frozen to market makers at a discount, and they are routing funds through multiple wallets to cover their tracks. TRM expects the next stage to use bridges and swap services, so this story is far from over.
The incident shows how dangerous a compromised transaction-signing system can be for a cryptocurrency exchange. Even with billions frozen, recovering the remaining funds could be difficult.
