In This Article
The hack of the largest exchange, Binance, has been linked to the North Korean hacker group Lazarus Group. Blockchain specialists suspect that North Korea-backed hackers stole around $6.3 billion from the exchange on October 29.
According to TRM Labs, its investigators attributed the attack with high confidence to TraderTraitor, a North Korean hacking unit linked to Lazarus. Blockchain specialist ZachXBT separately named Lazarus as the likely perpetrator, although Binance has not yet confirmed who exactly committed the theft.
Ido Ben-Nathan, co-founder and CEO of the blockchain security company Blockaid, said this attack surpassed previous cryptocurrency thefts in scale.
“This is the largest hack of cryptocurrency wallets in history. Our analysis shows that at least $3.5 billion was withdrawn from Binance hot wallets on the Ethereum, Arbitrum, Optimism, and Avalanche platforms in less than an hour, which is more than double the theft at Bybit in February 2025,” said Ben-Nathan.
He noted that investigators identified additional transfers using BTC and TRON, and that his team continues to track the stolen assets.
Meanwhile, the blockchain tracking platform Onchain Lens reported that the attacker who targeted Binance transferred 17,260 ETH, worth approximately $38.82 million, to a new wallet, raising concerns that the funds could be laundered through Tornado Cash or other cryptocurrency mixers.
According to the tracker, the attacker still controls nearly 480,720 ETH, valued at $1.08 billion, which cannot be frozen by the token issuer. The recipient wallet was identified as 0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea.
In the course of the investigation, TRM was able to trace the withdrawal of approximately $6.36 billion from wallets controlled by Binance across ten blockchain networks, including Ethereum, Bitcoin, Tron, Solana, and XRP Ledger.
Most of the stolen funds were transferred within approximately 20 minutes, starting at 20:05 UTC. Around $3.79 billion was moved via Ethereum, while Bitcoin and Tron accounted for another $1.47 billion and $628 million respectively.
Investigators found 233.46 million XRP, valued at nearly $296 million, held in five Binance wallets on Ethereum prior to the start of the attack.
According to the security firm, the preparation began at least 36 hours before the theft. Three small withdrawals from Tornado Cash were made to a wallet controlled by the attacker, and malicious code was tested before targeting Binance.
TRM linked this activity to TraderTraitor using blockchain transaction data and other information, although it did not publicly disclose all the evidence supporting its attribution.
Previously, the FBI determined that TraderTraitor was responsible for the theft of cryptocurrency from the Bybit exchange in February 2025, which resulted in around $1.5 billion being withdrawn from the exchange. US authorities accuse North Korean hacking groups of stealing cryptocurrency to fund the country’s weapons programs.
Blockaid explained how access to the Binance wallets was obtained
In the course of a technical investigation, Blockaid identified an unusual Ethereum transaction containing 50 EIP-7702 authorizations targeting Binance 14, one of the exchange’s busiest hot wallets.
EIP-7702 allows an Ethereum wallet to authorize smart contract code to operate on its behalf. The attacker prepared authorizations using 50 consecutive transaction nonces, increasing the likelihood that one of them would match the wallet’s current nonce.
Only one authorization succeeded, allowing the malicious contract to transfer assets out of the wallet.
“The attacker effectively reprogrammed a major Binance Ethereum hot wallet so that a single operator could drain it, including any new funds deposited into it,” Ben-Nathan explained.
The attacker transferred approximately $2.5 billion from Binance 14, including 167,464 ETH and more than $1.6 billion in USDT. Subsequent transfers targeted newly deposited funds.
Investigators found that other Binance wallets were moving assets via regular signed transactions across multiple networks. TRM believes the attacker may have gained access to the exchange’s transaction signing infrastructure.
Binance reported a possible hack of an employee’s laptop
In its security update, Binance said the initial investigation pointed to a compromised laptop of a DevOps engineer, which may have provided unauthorized access to an internal service container.
The exchange found no evidence of a private key leak and stated it would publish a detailed investigation once the cause was determined.
Tether CEO Paolo Ardoino confirmed the freezing of more than $1.567 billion in USDT, while Circle CEO Jeremy Allaire reported the freezing of more than 800 million USDC. The Arbitrum security council secured approximately 74.6 million ARB and 8,425 ETH tied to the attack.
Withdrawals remain suspended
Binance committed to covering the losses with its SAFU fund and company resources, while cooperating with law enforcement and blockchain-focused investigators.
At the same time, the exchange stated that deposits remain in effect, but withdrawals would be suspended while it upgrades its withdrawal and address control systems.
Binance expects withdrawals to resume within 48 hours and stated that a full report on the causes of the attack will be published later.
