ProCat Solutions

$6.3bn left Binance's wallets in twenty minutes, and the trail leads to North Korea

The largest crypto theft on record started with a developer's laptop. A minute-by-minute reconstruction of how the wallets were drained, where the money is going and what it means for the market.

October 30, 2026 ProCat Solutions BinanceCrypto securityNorth KoreaTraderTraitorLazarusEIP-7702Hot walletMoney laundering

$6.3bn left Binance's wallets in twenty minutes, and the trail leads to North Korea

Cartoon: a fictional comic-opera dictator with gold teeth and a gold watch on a golden throne in a room full of old computers, surrounded by gold coins — Illustration

Nineteen minutes. At 20:05 UTC on Thursday 29 October the first XRP left one of Binance’s wallets; at 20:24 a single transaction took $2.5bn off Ethereum. By the end of the night the world’s largest crypto exchange had suffered the biggest crypto theft ever recorded. Blockchain analytics firm TRM Labs puts the loss at $6.36bn at the prices of the moment; Binance’s own figure is $6.3bn. That is more than four times the Bybit heist of February 2025, the previous record.

The money did not come out of customer accounts. It came from the exchange’s own hot wallets, the always-online wallets Binance uses to pay out withdrawals. Cointegrity counted 17 of them across ten blockchains. The biggest share left Ethereum ($3.79bn, including 200,630 ETH and 1.875bn USDT); 18,270 BTC left Bitcoin, $628m left Tron and $296m left the XRP Ledger.

An empty open-plan office at night, a laptop left open on a desk next to a coffee mug and an access badge

The night, minute by minute

Based on TRM, Cointegrity, Elliptic and Cointelegraph’s live coverage, all times UTC:

28 October, morning
The attacker's wallet is funded with small withdrawals from the Tornado Cash mixer. Staging and testing run for at least 36 hours.
29 October, 15:59
The last "sweeper" smart contract is deployed.
20:05
Theft begins on the XRP Ledger; ordinary signed transfers drain wallets on nine chains until 20:48.
20:20:59
A bundle of 50 pre-signed EIP-7702 authorisations lands on Ethereum.
20:24:23
The first Ethereum sweep takes 167,464 ETH, 1.615bn USDT and 62 other tokens, about $2.53bn.
21:01 and 21:04
Tether freezes the main receiving address; Circle freezes 823m USDC.
21:15
The first public alert, from a researcher called Spreek on X.
Between 21:30 and 22:32
Binance halts withdrawals. Sources disagree on the exact time.
23:56
The last known sweep.
30 October, 00:30
TRM publishes its attribution to North Korea's TraderTraitor group. At 08:37 Binance mentions additional points of breach; at 10:55 it says $6.34bn has been set aside to cover losses.
31 October
Binance says 90 per cent of the stolen assets have been replaced.

How they got in

According to Binance chief executive Richard Teng, the attackers got in through the compromised laptop of a DevOps engineer. From there they reached a service container that could submit withdrawal transactions. By 30 October Teng was talking about further points of breach beyond the laptop, and said this was not a one-click job done with one engineer’s permissions. Binance says no private key leaked. The attackers wiped their tools with what Binance called a “self-destruct mechanism”.

That is the heart of the story. The keys were safe, but the attacker controlled the system that tells the keys what to sign. Cointegrity summed it up: the keys signed what they were asked to sign. Its analysis says five control points failed to trigger, without saying which.

The EIP-7702 trap

On Ethereum the attackers exploited a feature barely 18 months old. EIP-7702 went live with the Pectra upgrade on 7 May 2025 and lets an ordinary wallet delegate its behaviour to a smart contract. The convenience feature quickly became a criminal tool: a Wintermute analysis in June 2025 found that over 97 per cent of EIP-7702 delegations pointed to the same code, “sweeper” contracts that automatically drain compromised wallets.

At Binance, the attacker could not know in advance which transaction number the wallet would be on at the moment of execution. So it had 50 authorisations signed for consecutive nonces, 18,914,775 to 18,914,824. One matched, and the wallet labelled “Binance 14” became the attacker’s contract. The delegation acted as a standing order: every new inflow was swept, including fresh customer deposits. Hence six more sweeps over the following hours.

Security practice here is clear. A hot wallet’s signing service should refuse EIP-7702 authorisations outright, or allow them only for pre-approved contracts, and an alarm should go off when code appears at an exchange wallet’s address. Which control was missing at Binance is not known.

A man at a kitchen table in the evening looking at his phone, an open laptop and a half-eaten dinner beside him

The pattern: steal the signature, not the key

TRM named North Korea’s TraderTraitor group with “high confidence”; the US Treasury treats it as part of the Lazarus Group. Chainalysis also thinks it was likely them; Elliptic is more cautious. There is no government attribution. The FBI says it is aware of the incident, and the Secret Service has joined the investigation.

The method is familiar. In May 2024 Japan’s DMM Bitcoin lost $308m in BTC after a fake LinkedIn recruiter sent an employee of a wallet provider a program disguised as a hiring test. In February 2025 Bybit lost $1.5bn because a Safe{Wallet} developer’s machine was compromised through a poisoned Docker project, and code injected into the web interface led Bybit’s signers to approve a manipulated transaction; the FBI named TraderTraitor five days later. In September 2026 attackers at Bitget spoofed transaction data in a backend system to trigger the approval process. No keys were stolen in any of these cases. The targets are developers, suppliers and the point where a signature is produced.

Following the money

Stablecoins went first, because issuers can freeze them. According to TRM, the attacker swapped 325m USDT into about 122,300 ETH within 20 minutes, at a premium of more than 10 per cent over market. That was worth paying to get beyond the reach of a freeze. On the Aave lending market it borrowed 19,762 ETH against $60m of USDT; on Tron it deposited 300m USDT into JustLend and swapped 234m into TRX. Chainalysis says the laundering is automated, with scripts generating single-use addresses by the thousand.

Tether moved 37 minutes after the first Ethereum sweep. Including smaller issuers, TRM counts about $2.7bn frozen in total. The 18,270 bitcoin were split into 19 lots and, as of 30 October, none had moved; nor had the XRP or the SOL. TRM estimates that the attacker still holds about 420,000 ETH and all the BTC, beyond the reach of any issuer.

The Bybit proceeds were dealt with in ten days: 72 per cent of 499,000 ETH was converted to bitcoin through the cross-chain protocol THORChain. Elliptic says cashing out took much longer, months, through over-the-counter brokers. It expects the same now.

What it means for the market

On 30 October bitcoin fell as much as 3.3 per cent to $76,173, below $77,000 for the first time in a month. Ether lost about 6 per cent and BNB 7.6 per cent; spot ether ETFs had already seen $105.5m of outflows on 29 October. Bloomberg noted that part of the fall came from a selloff in tech stocks that day. By 31 October bitcoin had steadied around $77,600 and ether around $2,252.

The bigger question is the attacker’s remaining stash. The 18,270 BTC are worth about $1.4bn, which CoinGecko data put at 2.7 per cent of a single day’s bitcoin trading volume of $51.6bn. The 420,000 ETH, by 24/7 Wall St’s calculation, equal 3.6 per cent of daily ether volume, not enough on their own to push the price below $2,000. There are two scenarios:

A slow exit: if they follow the Bybit playbook, the money becomes bitcoin within weeks and then seeps out through OTC brokers over months. The direct price effect would be small.
A fast dump: trying to unload everything at once could cause a short, sharp drop, mainly in ETH. That is less likely, because exchanges and analysts are watching every move.

The more lasting effect is likely to be on trust and regulation. There was no run this time because withdrawals were switched off. The reopening on 1 November is the first real test, and the full zero-knowledge proof of reserves is due by 3 November.

Who holds the power over the money

Freezing saved almost half the stolen sum, but it has opened a debate. Anton Golub of Forte put it bluntly: when Binance gets hacked, the industry freezes nearly $3bn within hours; when smaller players get hacked, we hear about court orders. Circle did not freeze funds after April’s Drift theft, when it acted only on law-enforcement requests or court orders. Tether chief executive Paolo Ardoino says protecting the industry is the priority. Lawyers warn that an issuer could be liable for a wrongful freeze. Advocates of decentralisation ask how decentralised a market is when two companies decide the fate of billions.

Politics moved too. Donald Trump said the case is under review. CFTC chair Michael Selig cited it in arguing that offshore exchanges should be able to register under US oversight. Senator Cynthia Lummis said the CLARITY Act could give legal cover to firms that freeze suspicious funds. Binance holds no MiCA licence in the EU.

What we still do not know

How the attacker got from the laptop to the signing system, and why five control points did not trigger.
Exactly when withdrawals were halted: sources give anything between 21:30 and 22:32 UTC.
Who officially did it: no government has named the perpetrator.
Where the 18,270 bitcoin will go, and when.

One thing is already clear. Where an automated system signs withdrawals, the strongest key protection is useless if the attacker writes the signing request. Pre-signing checks, value limits and multiple independent approvals are now on the agenda of every crypto service provider.