📅 30 October 2026 • Binance
The largest crypto theft on record: about USD 6.36 billion was moved out of Binance wallets across 10 blockchains, including Ethereum, Bitcoin, XRP Ledger, Tron and Solana, with most of the funds moved in about 20 minutes, according to TRM Labs. The amount is about 4x the USD 1.5 billion Bybit hack of February 2025, the previous record incident.
Attribution and mechanism
According to Chainalysis CEO Jonathan Levin, the hack was likely carried out by the DPRK-linked group TraderTraitor, consistent with the earlier TRM Labs assessment. In February 2025 the FBI attributed the Bybit theft to the same cluster. Per TRM Labs, the attacker used the Ethereum EIP-7702 delegation feature with 50 pre-signed authorisations, and preparation began more than 36 hours in advance. Binance said the wallet delegation did not pass through its normal approval controls.
Chainalysis noted that once the movement began, the attacker raced to swap freezable assets such as USDT and USDC for non-freezable ones like bitcoin and ethereum. TRM Labs reported that about USD 2.4 billion remains beyond any issuer reach after the freezes. Bitcoin fell about 4 percent and ethereum about 5 percent on the news, per NBC News.
Company response
Binance confirmed about USD 6.3 billion impacted and temporarily suspended deposits and withdrawals. Co-CEO Richard Teng said the exchange reserved more than USD 6.34 billion of company funds to cover losses, including about USD 5 billion held in the impacted tokens. About USD 3 billion has been frozen with partners, and Tether, Circle, Ripple and World Liberty froze about USD 2.67 billion in stablecoins.
The company said user funds are safe, pledged to cover all losses and reported no evidence of a wallet private key leak. Deposits later resumed operating normally, and withdrawals are expected back within one to two days.
IMPACT
The incident moves custody risk to the top of compliance agendas. Expect tighter withdrawal controls and delay queues at major venues, review of EIP-7702 delegation in risk frameworks, and counterparty exposure checks for stablecoin issuers. The rapid freezes by Tether, Circle, Ripple and World Liberty show issuer-level controls working at scale, while the unfrozen remainder keeps on-chain monitoring critical. Compliance teams should refresh incident playbooks, counterparty limits and wallet-approval governance, and track the Binance post-mortem after the investigation.
Sources: binance.com • trmlabs.com • chainalysis.com • thehill.com • apnews.com • nbcnews.com
Sources:
- https://www.binance.com
- https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
- https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/
- https://thehill.com/policy/technology/6184178-north-korea-binance-crypto-hack
- https://apnews.com/article/binance-cryptocurrency-security-hack-north-korea-550e9b876550f71f07098494fe735beb
- https://www.cnbc.com/2026/10/29/circle-tether-freeze-funds-impacted-by-potential-binance-security-issue.html
Continue the conversation: https://t.me/ComplianceExplained · Bluesky
Top comments (0)