Binance 6 Billion Dollar Hack North Korea

An attacker drained 6.36 billion dollars from Binance in about 20 minutes across ten blockchains. No customer did anything wrong. The way in was one engineer’s laptop, rehearsed hours before.

Crypto theft has produced some huge numbers over the years, but nothing like this.

On the evening of October 29, someone reached into Binance, the largest crypto exchange there is, and walked out with 6.36 billion dollars. It took about twenty minutes, across ten different blockchains at the same time.

The people whose coins were sitting on Binance did nothing wrong.

The old record for a crypto theft was the Bybit hack in February 2025, which took 1.5 billion. This is more than four times bigger, and it is now the largest crypto theft ever recorded. When the news broke, Bitcoin dropped to a six-week low and Ether fell more than 3 percent. The market felt it.

Pulling this off is not what you would picture.

Binance keeps part of its coins in what the industry calls a hot wallet, a wallet that stays connected to the internet so the exchange can move money the moment a customer deposits or withdraws. Before any money leaves that wallet, an internal system has to sign the transaction, which is what tells the blockchain the payment really comes from Binance. That signing system is what the attacker reached. Once he had it, he could make it approve payments to himself.

Binance’s first explanation was short. The break-in, it said, may have started with a compromised laptop belonging to one of its DevOps engineers, the people who keep the exchange’s machines running. From that laptop the attacker reached an internal service and began sending out withdrawals that Binance never approved. The company said it found no sign of a stolen private key, the secret number that controls a wallet.

A day later, co-CEO Richard Teng made clear the laptop was only the start. The attacker went well beyond what one engineer could do, he said, and well beyond a single click: a longer, more involved process, with more than one point where he got in. Teng also said the attacker used software that wiped its own tracks while it worked, which made the attack harder to follow.

TRM Labs, which followed the money chain by chain, has a most likely read: the attacker got control of the system Binance uses to sign transactions, and made it sign whatever he asked. The keys themselves stayed put. Binance has not published its own root cause yet. Either way, the result was the same. Coins on ten different blockchains, each protected by a different kind of key, moved out with valid signatures inside the same half hour.

It also clears up something that looked like a contradiction. Binance says no key leaked, while a second security firm, Blockaid, counted eleven wallet keys signing the transfers. Both are right. The keys never left Binance’s own systems, and the machine that holds them signed on command.

On Ethereum the attacker used a feature that has only been around since May 2025.

It is called EIP-7702, and the idea behind it is friendly. It lets an ordinary wallet take on the powers of a smart contract, so it can do several things in one step or let someone else cover the transaction fee. To switch it on, the wallet owner signs once. That one signature can hand a contract full control of the wallet, and the control stays until the owner turns it off.

On a normal day it saves you time. In this attack it kept a Binance wallet under the attacker’s control after one signature.

At 20:20 UTC the attacker sent one transaction that carried 50 signed authorizations at once. Each one came from a Binance Ethereum hot wallet, known as Binance 14, and pointed it at a contract only he controlled. An authorization only works for one transaction number, and that number kept climbing because the wallet was busy handling withdrawals. By signing 50 numbers in a row, he made sure one would match the moment his transaction landed.

Three minutes and 24 seconds later, that wallet was empty. Gone in one sweep: 167,464 ETH, 63 different tokens, and 1.615 billion USDT. On the nine other chains he did not need the Ethereum trick; ordinary signed transfers moved the coins as fast.

The feature is a normal part of Ethereum now. EIP-7702 shipped as a regular upgrade, and plenty of legitimate wallets use it. But it has a side that security people warned about from the start. The same one-signature handover that makes a wallet easier to use is all a thief needs to empty it, and fake websites have been tricking people into signing it for months.

The same convenience is what let one signature drain a Binance wallet in a single move.

The money left in waves, and the order it left in shows how well prepared this was:

• → 20:05 UTC: five XRP wallets sent 233 million XRP in four minutes
• → shortly after 20:10 UTC: wallets on Solana and Optimism were emptied
• → 20:20 UTC: a Bitcoin wallet sent 18,270 BTC, and a Tron wallet sent 612 million USDT
• → 23:05 UTC: a second wave hit Avalanche and Polygon

None of this was improvised. The groundwork started more than a day before. The attacker began funding that wallet on October 28, in small amounts sent through Tornado Cash, a service built to hide where crypto came from. Early on the 29th he tried a first version of his draining code on two test wallets. Then he rehearsed the finished version on a third wallet and sent the test money back to himself, checking that it worked. About four hours later, that same code went onto a Binance hot wallet.

He rehearsed on throwaway wallets that afternoon and emptied Binance that evening.

Because the control stayed switched on, Binance’s own systems kept topping the wallet back up. One separate Binance smart account, never touched directly, still lost 823 million dollars in USDC, because it had standing permission to pay the wallet that was now hijacked. Circle froze that USDC soon after. Around 80 minutes after the first sweep, Binance’s own deposit-collection system swept another 204 million USDT into the hijacked wallet, but Tether had already frozen it, so the attacker got nothing from that batch.

Then came the race that decides how much ever comes back.

Much of what the attacker grabbed was stablecoins, coins like USDT and USDC that are run by companies and are always meant to be worth one dollar. Because a company runs them, that company can freeze the coins tied to a theft and make them useless to the thief. The attacker knew this, so he moved fast to get out of them.

He sold about 325 million USDT on decentralized exchanges and bought roughly 122,300 ETH with it before the issuers could react. With another wallet he put 60 million USDT into a lending service called Aave and borrowed about 19,760 ETH against it. Moving that fast came at a price: to offload the stablecoins he gave up somewhere between 10 and 26 percent of their value.

He was turning money that can be frozen into money that cannot.

It half worked. Tether froze 971 million USDT within the hour, and later said the total it had locked passed 1.567 billion. Circle froze 823 million USDC. Ripple, World Liberty Financial, and the group that governs the Arbitrum network added more, bringing the frozen total to around 2.7 billion dollars.

The stablecoin issuers moved faster than Binance did. Tether froze the main wallet at 21:01 UTC, more than an hour before Binance paused withdrawals. At 22:06 UTC it blacklisted the hijacked Binance 14 wallet outright, which also blocked Binance’s own transfers from that address. For the next hour Binance was racing the thief to pull out what it still could, and the attacker’s delegation came off only after midnight.

But the rest cannot be touched. More than 420,000 ETH and 18,270 BTC, worth about 2.4 billion, are plain Ether and Bitcoin. No company stands behind those two to freeze them, so that money is still sitting with the attacker.

Tracing where the rest went shows how this group launders money. On Tron, 300 million USDT went into a lending service called JustLend. He swapped another batch on open exchanges. The Ripple stablecoin moved in two hops, and part of it was sold off. The 18,270 Bitcoin were split through a short peel chain into 19 addresses, most holding 1,000 coins each, a known way to make the trail hard to follow. TRM expects the next stage to run through cross-chain bridges and brokers who turn crypto into cash.

If you had money on Binance that night, you did not lose it.

Binance says it is covering the losses out of its SAFU fund, an emergency fund it started in 2018, and out of its own money. It has set aside about 6.34 billion dollars to do it. It paused withdrawals for a while to rebuild the system that was abused.

The last question is who.

The firms that trace stolen crypto for a living point to the same group: TraderTraitor, a hacking team that works for the North Korean state, inside the group the industry calls Lazarus. TRM Labs calls it high confidence, Chainalysis its assessment, Elliptic likely. This is a familiar name. The FBI, the US cyber-defense agency CISA, and the US Treasury named it back in 2022, for doing exactly this kind of thing to crypto companies. The Treasury sanctioned Lazarus as far back as 2019, and the same team got the blame for that Bybit hack last year.

North Korea keeps showing up in these stories for a reason. Crypto theft has become one of the ways the country brings in hard currency while it sits under heavy sanctions, and TraderTraitor has spent years going after exchanges, trading firms, and people holding large amounts of coins.

For North Korea this is a revenue stream, run by professionals.

The money ties it to one more case. An independent investigator who goes by ZachXBT showed that funds from this theft and from a separate 388 million dollar hack of the Bitget exchange in late September ended up mixed at the same address. That points toward one team behind both, though the shared amount so far is small.

A word of caution here. Working out who did it is one of the hardest parts of this field. Addresses get reused, tools get shared, and a trail can be laid on purpose to point at the wrong people. Elliptic adds a detail of its own: the thief was slow to move the money, which let more than 2.6 billion be frozen, and that is not how North Korean crews usually work. No government has confirmed the attribution. What investigators can prove is how the attack worked and where the coins went. Binance itself has stayed silent on who did it, and in Teng’s words the investigation has not pinned it on any individual.

The lesson here is a quiet one. The blockchain did its job. What failed was everything around it: a compromised laptop, more than one way into Binance, a day and a half of quiet setup, and a wallet feature that millions of people now have switched on.

That last part is something you can check yourself. On a site like revoke.cash, or in your wallet’s own settings, a delegation shows up as code starting with ef0100. Spot a delegation you never put there, revoke it, and move your coins to a fresh address.

If you hold Ethereum, take two minutes today to check your wallet for a delegation you never set.

Seeing how attackers get that first foothold, through phishing and social engineering, is where ethical hacking begins.

My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

TRM Labs | Elliptic | Chainalysis