Quick answer: TRM Labs said on Oct. 30, 2026 that North Korea’s TraderTraitor unit was behind the Binance hack, which Binance now puts at about $6.3 billion. About $3 billion is frozen, Binance will cover all losses, and withdrawals are expected to resume within 48 hours, per Binance, Cointelegraph and CNBC.
The Binance hack now has a suspect. Blockchain analytics firm TRM Labs says North Korea’s TraderTraitor unit carried out the theft, and Binance puts the total impact at about $6.3 billion, so it would be North Korea’s largest known crypto raid.
That figure is roughly four times the $1.5 billion Bybit theft of February 2025. Meanwhile, Binance says it will cover every loss with its SAFU fund and company money.
What happened in the Binance hack
Our first report on the breach tracked $2.54 billion in frozen funds. Since then, the picture has changed in three ways.
First, the size grew. Binance said late Thursday on X that “the estimated total impact sits at around $6.3B,” according to NBC News. TRM Labs counts about $6.36 billion moved out of Binance wallets on ten blockchains, most of it in about 20 minutes.
Second, the entry point is clearer. Specifically, Binance says early checks point to a compromised DevOps engineer’s laptop. In turn, that access let an attacker reach a service container and submit unauthorized withdrawals. Binance also adds that it found no sign of a private key leak.
Third, attribution arrived. TRM Labs says it links the attack to TraderTraitor “with high confidence,” based on on-chain and off-chain intelligence. Chainalysis CEO Jonathan Levin also named the group on X, per Cointelegraph. In addition, the FBI has previously tied TraderTraitor to the Bybit theft.
How the attacker drained the wallets
On Ethereum, the attacker used EIP-7702, a feature that lets a wallet hand its actions to smart contract code. Blockaid says the attacker bundled 50 such authorizations into one transaction. Then one of them matched the wallet’s nonce and went through. As a result, a Binance hot wallet was pointed at a sweeper contract that could empty it.
On the other nine chains, funds left through normal signed transactions. TRM therefore believes Binance’s hot wallet signing system was compromised, not a single key.
This matters for every exchange because the keys stayed safe, yet the system that uses them was turned against its owner.
Why the Binance hack matters for North Korea and crypto
North Korea’s hackers have targeted exchanges for years. However, a single $6.3 billion haul would dwarf past cases. It also arrives soon after the US sanctioned North Korean IT workers tied to crypto revenue.
Even so, stablecoin issuers moved fast. Tether froze about $1.6 billion and Circle more than $800 million, per the BBC. TRM counts about $2.67 billion in frozen stablecoins from Tether, Circle, Ripple and World Liberty Financial. On top of that, the Arbitrum security council froze another $30 million or so.
Still, a large share is out of reach. TRM says the attacker holds over 420,000 ETH and 18,270 BTC, worth about $2.4 billion. Unlike stablecoins, those assets cannot be frozen by an issuer.
Market data: liquidations and prices
The Binance hack hit the market hard. CoinGlass data cited by CoinDesk shows $1.53 billion in liquidations over 24 hours. Long positions made up 83.8% of that total. At one point, Bitcoin briefly fell to about $76,460.
At 07:52 UTC on Oct. 30, CoinGecko showed these prices:
| Asset | Price | 24h change |
|---|---|---|
| Bitcoin (BTC) | $78,130 | -2.1% |
| Ether (ETH) | $2,231.54 | -3.2% |
| BNB | $706.48 | -5.6% |
| Hyperliquid (HYPE) | $91.70 | +16.5% |
HYPE stands out, though. Traders appear to be rotating toward decentralized venues, a move that also follows ICE’s plan for Hyperliquid perps. Standard Chartered’s Geoffrey Kendrick told CoinDesk that prices may fall further. In his view, a new base comes only after assets are unfrozen and more details emerge.
The hack also came hours after the Polymarket breach. Two incidents in one day put security back at the center of the market.
What to watch next after the Binance hack
Withdrawals are the key test. Binance co-founder Yi He said on Oct. 30 at 04:17 UTC that withdrawals should begin to resume within 48 hours. Deposits, she said, work as normal. That window runs to about 04:17 UTC on Nov. 1.
Next, watch for a staged reopening, chain by chain. Also, look for the updated Proof of Reserves that Binance promised, plus its technical post-mortem.
Finally, track the 420,000 ETH. If it moves through mixers or bridges, recovery gets harder. On the other hand, if more is frozen, the final loss could shrink.
For users, the Binance hack is a reminder that the basics still apply. Keep long-term holdings in self-custody, protect your seed phrase, and use a separate spending tool, such as the crypto cards we review, for daily payments.
Binance hack FAQ
Who is behind the Binance hack?
TRM Labs attributes the Oct. 29, 2026 attack to TraderTraitor, a North Korean hacking unit, with high confidence. Chainalysis CEO Jonathan Levin also named the group. Binance itself has not named the attackers and says it is working with law enforcement.
Are Binance user funds safe?
Binance says user funds are safe and that it will cover all losses with its SAFU fund and company funds. In addition, it plans to publish an updated Proof of Reserves.
When will Binance withdrawals resume?
Binance co-founder Yi He said on Oct. 30, 2026 at 04:17 UTC that withdrawals should begin to resume within 48 hours. Deposits continue to work as normal, according to Binance.
Sources
- TRM Labs attribution, reported by The Korea Times
- Cointelegraph: Binance points to engineer’s hacked laptop
- Cointelegraph live updates on the Binance hack
- NBC News: Binance targeted in $6.3 billion heist
- BBC: Binance hit by hack suspected to be largest in history
- CNBC: Bitcoin tumbles as Binance hack rattles markets
- CoinDesk: selloff wipes out $1.5 billion in leveraged bets
- CoinDesk: Standard Chartered sees more pain
- FinanceFeeds: Binance withdrawals to resume within 48 hours
- CoinGecko live prices
This article is for information only and is not financial advice. Do your own research before you buy or sell any crypto asset.
1 comment