Binance’s $6.36bn Hack: Only Coins With an Off Switch Were Stopped

ByMax Dvornik
Dark trading floor with monitors showing falling crypto prices after the Binance hack

North Korea’s TraderTraitor hacking unit, according to two blockchain analytics firms, took about $6.36bn from Binance on October 29. It emptied the exchange’s internet-connected wallets on ten blockchains, most of it in about 20 minutes from 20:05 UTC. Then the companies behind dollar tokens began switching them off. Tether froze 971.1m USDT 37 minutes after the main sweep, and Circle froze 823m USDC three minutes later, stopping about $1.8bn in 40 minutes. The attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4bn that no issuer can freeze, according to TRM Labs.

Companies that issue dollar tokens can block any wallet holding them, the way a bank freezes an account. Bitcoin and ether have no issuer to call. Crypto is sold on the promise that nobody controls your money, and that night the only money anyone stopped was money somebody controls.

Who did what

  • The thief: North Korea’s TraderTraitor hacking unit, according to the blockchain analytics firms TRM Labs and Chainalysis. Binance and the FBI have not named anyone.
  • The victim: Binance, the world’s biggest crypto exchange. It says it will cover every customer’s loss.
  • The companies that froze money: Tether, Circle, Ripple and World Liberty Financial, which issue the dollar tokens that were stolen, plus the Arbitrum Security Council. Together they stopped about $2.7bn.
  • The buyers: unnamed trading firms that bought stolen dollar tokens at a discount.
  • What got away: about $2.4bn in ether and bitcoin, which nobody can freeze.

Binance’s own customers could not reach theirs. Withdrawals were halted, and on October 30 Solana and XRP withdrawals were still paused. Leveraged traders could not add margin while deposits were frozen, so their positions were liquidated anyway. Their protection is a company pledge to repay them, not a deposit guarantee.

TRM attributes the theft “with high confidence” to TraderTraitor, the group behind the $1.5bn Bybit theft in February 2025, which the FBI blamed on North Korea within a week. Chainalysis reached the same attribution independently by tracing the stolen funds being mixed with proceeds of an earlier theft from the exchange Bitget. On the other side, North Korea’s UN mission denied any involvement, as reported by CNN. Binance has named no perpetrator, and Trump said he did not know whether North Korean hackers were responsible.

Reader be advised, though: Trump doesn’t know shit about fuck.

Chainalysis puts the theft at about $6.4bn, and Binance’s own estimate is about $6.3bn. Either figure is four times Bybit’s loss and the largest crypto theft on record. TRM now puts North Korea’s all-time crypto theft at about $12.8bn since 2017, $7.4bn of it in 2026.

The freezes came one company at a time. TRM’s count as of 00:30 UTC on October 30:

Company What it froze, and when (UTC)
Tether 971.1m USDT in the main receiving wallet at 21:01, 37 minutes after the main sweep; about 1.77bn USDT in all
Circle 823m USDC at 21:04, “in coordination with law enforcement”; 1.56m more later
Ripple 40.5m RLUSD at 22:01
World Liberty Financial 27.8m USD1 at 22:10; USD1 in the compromised Binance wallet at 22:26
Arbitrum Security Council 8,426 ETH and 74.6m ARB, about $30m, forced out of the attacker’s wallet at 00:08

Arbitrum is a network that runs on top of Ethereum. Its Security Council is a committee with emergency powers over that network, and it used them to move coins out of a wallet whose owner had signed nothing. That is still an off switch, held by a committee instead of a company.

Ripple shows where the switches stop. It froze RLUSD, its dollar token. It could do nothing about XRP: the 233.46m XRP, about $296m, taken in the first four minutes has sat in an attacker address ever since. Most of the money that is neither frozen nor held as ETH and BTC is like that. It includes 970,500 SOL, 300m USDT pushed into the Tron lending platform JustLend, and 48m RLUSD sold before Ripple’s freeze landed.

Divide TRM’s $2.7bn frozen by its $6.36bn stolen and companies stopped about 42 cents of every stolen dollar. Bybit’s victims got about 3 cents. Weeks after that theft, which was almost all ether, about $43m had been frozen, and more than $1bn later went dark. The response this time was not the difference. The difference was that Binance’s haul was heavy with tokens that have an issuer. The frozen counts vary by snapshot: Binance reported $2.54bn at 23:35 UTC, TRM $2.7bn at 00:30, Chainalysis about $2.8bn, and Binance later about $3bn.

Split of the 6.36bn stolen from Binance: 2.7bn frozen by token issuers, 2.4bn in ETH and BTC beyond their reach, and about 1.26bn in other tokens

The attacker understood the switch and paid to beat it. TRM says about 325m USDT was sold to market makers and “professional fillers” through UniswapX and similar trading contracts for about 122,300 ETH. That is roughly $2,650 per ETH while ether traded at $2,300 to $2,350, a haircut of more than 10% to get out of freezable tokens. Chainalysis describes the same trade as $325m of stablecoins swapped for $285m of ETH.

Another wallet deposited 60m USDT on the lending platform Aave and borrowed about 19,760 ETH against it. Aave then froze the affected markets, and Coinbase blocked transactions involving the compromised wallets. Those were two more switches, thrown by two more companies.

Somebody earned money on that fire sale. Bitquery’s trade-by-trade analysis finds the hacker lost about $119m on bad prices. Arbitrage traders and bots collected $59.9m of it, block builders and validators $29.5m, and liquidity providers $20.2m. The fillers who took the orders kept only about $6.7m and passed most of their margin along. The market did not refuse North Korea’s money. It charged a fee to convert it.

For anyone holding stablecoins, the lesson runs in both directions. A reader holding USDT in a wallet they control owns a balance Tether can stop with a single transaction. That is the feature that worked on October 29, at a scale far beyond Tether’s usual practice: its largest single freeze before this, on BlockSec’s tracker, was $344m in April 2026.

Who gets that protection is the company’s choice. Anton Golub of Forte, a former exchange executive, called the response a “double standard”. In the April 1 Drift theft, Circle froze none of the roughly $230m in USDC that moved, saying it froze funds only when “legally compelled… through lawful process”. In May it added an exception for “certain urgent law enforcement requests pending a valid court order” and disclosed it in a footnote to a June 22 court filing. Drift users suing Circle are challenging the change. The rule that stopped $823m on Binance’s behalf was rewritten after Drift, by Circle, in a footnote.

A reader holding USDT in a wallet they control owns a balance Tether can stop with a single transaction.

A freeze is also not a refund. TRM policy chief Ari Redbord said recovery requires a separate legal process, potentially including court orders and coordination with the issuers.

One signing system emptied Binance hot wallets on ten blockchains

A hot wallet is an internet-connected wallet an exchange uses to pay out customer withdrawals. Coins a customer leaves on an exchange sit wherever the exchange chooses to put them. Binance held $162.8bn in customer assets, and at least $6.36bn of it sat where this attacker could reach it. Self-custody has its own thieves, such as a fake Ledger app that drained hardware-wallet users, but those thieves have to work through one victim at a time.

Binance’s preliminary finding is that a DevOps engineer’s laptop was compromised. The attacker used it to reach a service container, a sealed-off piece of software, and submit withdrawals nobody had authorised. Binance says it found no sign that private keys leaked. That is less reassuring than it sounds. CryptoTicker’s account of Binance’s finding puts it plainly:

“No key was cracked. A system was made to treat a payout as valid.”, CryptoTicker

The keys never left. The system that holds them signed for whoever had the access, and that kind of failure is worse for a customer, not better.

The attack was planned well in advance. TRM says preparation began at least 36 hours earlier. The operator wallet was funded through the mixing service Tornado Cash from the morning of October 28. Early on October 29 the attacker tested its code on two wallets and rehearsed the final version on a third. Four hours later, the same code was installed on a Binance hot wallet.

At 20:20 UTC the attacker submitted 50 pre-signed authorisations under EIP-7702, a 2025 Ethereum feature that lets a wallet hand its behaviour to a piece of code. Each wallet keeps a running transaction count, and an authorisation only works at the count reached when it executes. Binance’s wallet was processing a steady stream of withdrawals, so the attacker signed 50 consecutive counts to make sure one would still be valid. TRM reads the batch as a sign that the access was limited in time or had to be requested through a system.

Three minutes and 24 seconds later, one transaction moved 167,464 ETH and 1.615bn USDT. The wallet then stayed under the attacker’s control. As Binance kept routing new funds into it, the attacker swept it again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56, for three and a half hours. Ripple at 22:01 and World Liberty at 22:26 froze their own tokens inside Binance’s compromised wallet so that new deposits could not be taken.

The attacker did not need the delegation trick at all. A second Binance Ethereum hot wallet sent 28,006 ETH, 55.7m USDT and 25.9m RLUSD through ordinary signed transfers, which rules out the early theory that the authorisations had been phished. Binance wallets on the other nine chains, with different key types and signing schemes, did the same. At 23:05 UTC, three hours after the first theft, wallets on Avalanche and Polygon were still signing transfers to the attacker. TRM concludes the attacker could make Binance’s hot-wallet signing system sign whatever it wanted. Its advice to other exchanges reads as a list of what Binance had not done:

“Signing infrastructure and approval paths should be separated by chain and wallet tier.”, TRM Labs

Co-CEO Richard Teng later called it a “complex attack” that was not carried out by one person and involved malware built to delete evidence. Later findings point to more than one route in. The complexity was in the preparation, though, not in the way in. Bybit’s 2025 loss began on a compromised developer machine, and the FBI named this group and its tactic within a week. Twenty months later, one foothold at Binance produced valid signatures on ten chains. Binance has not published a root cause.

One laptop connected by lines to ten wallets, all draining at once

USD1, a pardon, and who holds the switches

World Liberty Financial, whose USD1 freeze landed at 22:10, is the crypto company that lists Donald Trump and three of his sons as co-founders. The Trump family was not robbed and is not accused of any part in the theft. World Liberty is in this story because it is one of the few companies that can switch money off, and because of its ties to the exchange that was hit. In March 2025, Abu Dhabi’s MGX announced a $2bn investment in Binance, to be paid in stablecoins. In May 2025, co-founder Zach Witkoff named USD1 “the official” stablecoin for the deal, and Eric Trump announced that it would settle in USD1. At the same event he said, “Crypto makes banks redundant.” On October 29 his family’s stablecoin froze an account.

Binance paid about $4.3bn in 2023 over money-laundering and sanctions failures, and founder Changpeng Zhao pleaded guilty. Trump pardoned Zhao in October 2025, by which time he had taken more than $57m from World Liberty. In December 2025, Binance added USD1 trading pairs and moved its B-Token collateral into USD1. At that point nearly $2.8bn of USD1 was circulating, and “a large majority” of it came from MGX’s Binance deal. World Liberty said at the time:

“The transition means USD1 will become an integral part of Binance’s updated collateral structure, further embedding the stablecoin within the exchange’s ecosystem.”

What the record does show is who holds the switch. A company co-founded by the president’s family, by the same family that runs other paid market businesses, can stop money moving through the world’s largest exchange. Most of its stablecoin’s supply came from an investment in that exchange.

The unfrozen $2.4bn has a destination. In March 2024, a UN Panel of Experts reported member-state estimates that cyber theft supplies about half of North Korea’s foreign-currency income and 40% of its weapons-of-mass-destruction funding. An October 2025 report by the US and ten allies tied crypto theft to its missile programmes.

Binance says it will cover every loss from its SAFU reserve and company funds. That reserve held only about $1bn to $1.3bn in mid-October. The ether taken was about 5.6% of Binance’s ETH reserves, enough to cut backing from 100% to about 94% unless it is replaced. The co-CEOs say about 80% of the stolen coins have already been replaced. Lawyers say the pledge is not legally binding.

Each piece of this now waits on someone else’s decision. TRM expects the ETH and BTC to reach bridges, swap services and OTC desks within days, where they can be stopped only if a cooperating exchange’s compliance desk chooses to. The frozen $2.7bn waits on a legal process that in past state-linked cases took years. Binance’s customers, sold on money that nobody controls, hold a promise from the company that lost their coins, with the first check due on November 2.

Further Reading