The cryptocurrency world has been shaken by one of the largest cyberattacks ever recorded. Around $6.36 billion worth of crypto assets were moved from wallets associated with Binance, according to blockchain intelligence firm TRM Labs.

The investigation has strongly linked the incident to TraderTraitor, a North Korea-linked hacking group. TRM Labs said the attacker moved billions of dollars across 10 different blockchains, with most of the transfers taking place within roughly 20 minutes.

Billions Moved Within Minutes

The attack began on October 29, 2026, and involved several major blockchain networks, including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.

According to TRM Labs, approximately $3.79 billion was moved from Ethereum-related Binance wallets, while Bitcoin-related outflows were worth around $1.47 billion. Tron accounted for another roughly $628 million.

The total value of the assets moved was estimated at approximately $6.36 billion, making the incident the largest cryptocurrency theft recorded so far.

How Did the Attack Happen?

Investigators believe the attackers had prepared the operation well in advance.

On Ethereum, the attackers exploited a mechanism involving EIP-7702, allowing a Binance hot wallet to execute code controlled by an attacker through a smart contract. The attackers then used the compromised wallet to transfer large amounts of cryptocurrency to addresses under their control.

TRM Labs said preparations for the attack began well before the main theft, with the attackers testing their code and preparing the infrastructure needed to execute the operation.

Why Is North Korea Suspected?

TRM Labs attributed the attack to TraderTraitor, a hacking group linked to North Korea, with what it described as high confidence.

The group has previously been linked to some of the biggest cryptocurrency thefts in the world. In February 2025, North Korea-linked actors associated with TraderTraitor were blamed for the theft of nearly $1.5 billion from Bybit.

The latest Binance incident is roughly four times larger than the Bybit theft, making it an unprecedented event in the cryptocurrency industry.

Around $2.7 Billion Frozen

Following the attack, several cryptocurrency companies moved quickly to freeze stolen assets.

TRM Labs said Tether, Circle, Ripple and World Liberty Financial froze around $2.7 billion worth of assets. However, a significant amount of cryptocurrency remained beyond the reach of issuers.

According to TRM, the attacker still controlled more than 420,000 ETH and 18,270 BTC, worth roughly $2.4 billion at the time of its analysis.

Binance Responds

Binance launched an investigation into the incident and temporarily suspended withdrawals on several networks as a security precaution.

The exchange has said that customer funds are safe and that it will address the losses associated with the incident. Binance is also working with law-enforcement agencies and security researchers to identify the attackers and determine exactly how the compromise occurred.

A Major Warning for the Crypto Industry

The Binance incident highlights the growing cybersecurity risks facing cryptocurrency exchanges and digital asset platforms.

North Korea-linked hacking groups have increasingly targeted cryptocurrency companies, exchanges and blockchain infrastructure in recent years. The latest attack demonstrates how sophisticated these operations have become—and how quickly billions of dollars in digital assets can be moved across multiple blockchain networks.

The investigation into the Binance breach is still ongoing, and further details about the attack and the identity of those responsible are expected to emerge.