Record $6.3 Billion Binance Crypto Heist: North Korean Hackers Suspected
North Korean state-sponsored hackers are have been identified by blockchain analysts as the suspected perpetrators behind the massive $6.3 billion raid on Binance, marking the largest crypto heist in history. The attack targeted assets across ten blockchains and may have involved a compromised engineer’s laptop, according to Binance’s preliminary investigation.
According to TRM Labs, the bulk of the multi-billion-dollar transfer was completed within a 20-minute window, beginning at 20:05 UTC on Thursday, October 29, 2026. In response, Binance said it had worked with industry partners to freeze about $3 billion in affected assets. Meanwhile, the platform has agreed to cover all user losses and has temporarily suspended deposits and withdrawals.
The Attack Vectors
Initial reports indicated a simple exploit. However, Binance later clarified that this was a highly sophisticated, multi-staged cyber attack. Binance’s preliminary investigation suggests that the breach may have originated from a compromised laptop belonging to a Binance DevOps engineer.
According to Binance, the suspected laptop compromise may have allowed an attacker to access an internal service container. Binance said it had found no evidence of a wallet private key leak. The attack was initiated through a laptop, but Binance’s security teams later uncovered multiple, additional points of breach used by attackers to maintain access.
Separately, TRM Labs, a blockchain intelligence firm, described the technical mechanism of the attack on the Ethereum network. The attackers used EIP-7702, an Ethereum feature that allows ordinary wallets to run smart contract code via signed authorization. The attackers submitted 50 pre-signed authorizations, one of which took effect, to force a Binance hot wallet to run a custom “sweeper contract”. This contract accepted instructions only from the attacker. As a result, the attackers were able to drain funds from the affected wallet.
Funds were transferred out of Binance wallets across 10 different blockchain networks. These networks included Bitcoin, Ethereum, Tron, Solana, XRP Ledger, Arbitrum, Avalanche, Optimism, Base, and Polygon.
The Alleged Culprit
Top blockchain analytics firms have attributed the attack to elite state-sponsored cyber warfare unit known as TraderTraitor. The FBI previously attributed the 2025 Bybit hack to North Korea and identified the activity as TraderTraitor. These state-linked actors systematically target centralized exchanges to bypass severe international sanctions. Authorities have warned that proceeds from North Korean cryptocurrency theft help finance the country’s weapons programmes. North Korean officials have denied state-linked hacking allegations in the past. Binance has stated that it is working with law enforcement agencies to determine the identities of the perpetrators.
