An image showing Binance’s logo

Binance says hackers who stole billions in crypto spent months planning heist

by

On October 29, 2026, hackers stole $6.43 billion in cryptoassets from Binance, the world’s largest cryptocurrency exchange, according to blockchain analytics firm Elliptic — a haul Binance itself estimates at around $6.3 billion and that the FBI has attributed to North Korea’s TraderTraitor group. It is the largest single theft of any kind on record.

One Laptop, Then a Months-Long Campaign

Binance’s postmortem, published November 3, tells a different story from its first account of the breach, which pointed to a single compromised laptop: a complex attack that was not carried out by one person. Co-CEO Richard Teng told CNBC’s Squawk on the Street that the attackers spent months building their way in, rejecting the idea of one point of failure.

The campaign began in June, when a Wallet DevOps engineer downloaded a trojanized Homebrew installer after searching for a popular AI coding tool. Binance says it detected that download, replaced the device and rotated credentials — but the engineer’s role and his colleagues on the wallet infrastructure team had already been exposed to the hackers.

In September, a second engineer received messages through a legitimate job-hunting platform from someone posing as a project director. Fake interviews followed — one by video with a supposed HR representative who shared a social media account full of personal photos, one on a chat app with the fictitious company’s purported CEO — before the engineer was told to download a coding assignment that contained hidden malware.

The 0-day malware slipped past endpoint security tools, replaced a legitimate development component with a malicious version, and the attackers removed forensic traces to cover their tracks. On October 20, they used the second engineer’s computer and an internal AI tool to take over two more engineer devices. Nine days later, between 17:15 and 19:56 UTC, they logged into a third engineer’s machine, deployed a container and triggered the script that launched the theft.

Twenty Minutes Across Ten Blockchains

TRM Labs, which put the total at about $6.36 billion, says most of the money moved in roughly 20 minutes starting at 20:05 UTC. From 20:05 to 20:09, five Binance wallets transferred 233.46 million XRP to a single attacker address, leaving each with only its minimum balance. At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to the attacker.

On Ethereum, the attackers used an EIP-7702 delegation — 50 pre-signed authorizations prepared in advance — to turn a Binance hot wallet into a sweeper contract they controlled. Three and a half minutes after the delegation, it emptied the wallet of 167,464 ETH and 63 tokens, including 1.6 billion USDT. Because the hot wallet used Multi-Party Computation, Binance says, there was no single private key that could immediately revoke the malicious authorizations.

Binance logo over chart
Photo: Arstechnica

The laundering moved just as fast. Elliptic reports the hackers used about 12,000 wallets across 11 blockchains for roughly 40,000 transactions, shuffling funds to a new wallet every 25 seconds. TRM says the attacker still controls more than 420,000 ETH and 18,270 BTC — worth about $2.4 billion — even after the freezes.

$2.85 Billion Frozen Against $6.43 Billion Stolen

Elliptic has confirmed $2.85 billion of frozen or seized funds — 44% of the theft, with nearly all of it in USDT and USDC. Binance and industry partners including Tether, Circle and Ripple reportedly froze about $3 billion in total; Ripple helped stop about $200 million in RLUSD, World Liberty Financial froze 27.8 million USD1, and the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB.

Binance says no user is bearing the loss. As of October 31, 98% of the $6.34 billion in affected assets had been replenished and verified on its Proof of Reserves page, with withdrawals resuming November 1 starting with the Bitcoin network. Teng said the company is working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds.

A Record Loss With No Cyber Insurance Behind It

Binance has been unable to obtain cyber insurance, according to a person familiar with the matter, so its policies cover only a fraction of the loss. Its Secure Asset Fund for Users, an emergency reserve created in 2018, holds crypto assets valued at about $1 billion. The exchange absorbed about $4.7 billion in net outflows as of Monday while making customers whole from corporate accounts and reserve funds.

On October 31, the FBI formally named TraderTraitor, the North Korean unit also tied to the $1.5 billion Bybit hack of February 2025; Elliptic and TRM had already assessed the group as the likely culprit. Binance says it blocked 57 separate North Korea-linked attempts throughout 2026. Elliptic notes this single incident nearly doubles the more than $6.5 billion in cryptoassets that DPRK-linked actors are believed to have stolen in recent years. North Korea has denied responsibility, and it is not yet known how much of the $2.4 billion the attacker still controls can be recovered.

More on Richard Teng

The $6.3 Billion Binance Hack — How Hackers Stole Billions in 20 Minutes
Hackers Just Stole $6.3 Billion From Binance in 20 Minutes
How crypto hackers drained Binance of $6.3 billion in 20 minutes | DW News
The $6.3 Billion Heist: How Hackers Stole Billions in 20 Minutes

Keep reading

Read next