On the evening of October 29, 2026, wallets tied to Binance began sending large volumes of crypto across ten blockchains in a tightly timed operation. TRM Labs traced roughly USD 6.36 billion in outflows and attributes the attack to North Korea’s TraderTraitor unit. Stablecoin issuers and network councils froze about USD 2.7 billion, but the attacker still controls roughly USD 2.4 billion in assets that remain beyond issuers’ reach. This article reconstructs what happened, how the attacker operated on Ethereum and other chains, and what exchanges and compliance teams should do now.
The night the vaults emptied
Beginning at about 20:05 UTC, funds started moving out of known Binance wallets. In the first burst, five Binance XRP Ledger wallets sent 233.46 million XRP to a single attacker address. Within minutes, wallets on Solana, Optimism and other networks followed. At 20:20 UTC a Binance Bitcoin hot wallet transferred 18,270 BTC; the attacker immediately split many of those coins into 1,000- and 100-BTC chunks in the same block, a technique known as a peel chain. Additional waves of theft continued through the night, with Avalanche and Polygon affected around 23:05 UTC. Binance confirmed a security incident and temporarily suspended withdrawals on multiple networks while investigations continued.
Who is TraderTraitor?
TRM attributes the operation to TraderTraitor, a North Korean state-linked hacking unit, based on a combination of on-chain indicators and off-chain intelligence. TRM notes behavioral similarities to prior North Korea-linked incidents—small Tornado Cash withdrawals that seeded operator wallets, long staging and rehearsal activity before the theft, and prepared signatures executed in a narrow time window. TRM reports high confidence in this attribution and is sharing address data through its Beacon Network.
How the attacker abused EIP-7702 to seize an Ethereum hot wallet
On Ethereum the attacker exploited EIP-7702, an upgrade that allows a wallet to delegate execution to a smart contract by signing an authorization. The attacker submitted one transaction containing 50 authorizations, each signed by a Binance hot wallet and each pointing to a sweeper contract controlled by the operator. Because authorizations are tied to a wallet’s nonce, preparing 50 consecutive authorizations ensured at least one remained valid when the transaction executed amid normal withdrawal activity. Once the delegation executed, the attacker instructed the wallet to transfer its balance—moving 167,464 ETH and dozens of tokens, including over 1.6 billion USDT. The delegation persisted and was used to sweep incoming funds repeatedly that night.
Evidence of a signing-infrastructure compromise across chains
While the Ethereum activity relied on a delegation, Binance wallets on nine other chains produced valid attacker-authorized signatures and completed ordinary signed transfers in the same general timeframe. Those wallets use different chains, key types and signing schemes, yet all yielded valid signatures for attacker transactions within about half an hour. TRM’s assessment is that the attacker gained the ability to make Binance’s hot-wallet signing system sign transactions of its choosing across multiple chains—an explanation that fits the cross-chain simultaneity better than separate, chain-by-chain key compromises.
How much was taken (chain-by-chain totals)
TRM traced transfers from Binance-attributed wallets to attacker-controlled addresses and valued each transfer at the asset price at the time of movement. Major totals include:
- Ethereum: about USD 3.79 billion — roughly 200,630 ETH plus 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD.
- Bitcoin: 18,270 BTC, about USD 1.47 billion.
- Tron: 612.7 million USDT and 46.4 million TRX, about USD 628 million.
- XRP Ledger: 233.46 million XRP, about USD 296 million.
- Solana: 970,500 SOL, about USD 96 million.
- Arbitrum, Optimism and Base combined: about USD 39 million, including 74.6 million ARB on Arbitrum.
- Avalanche: about USD 28 million.
- Polygon: about USD 10 million.
The traced outflows total approximately USD 6.36 billion at the moment they moved (about USD 6.23 billion at current prices cited by TRM).
Stablecoin freezes, conversions, and attacker countermeasures
Stablecoin issuers and network authorities froze a large portion of the stolen assets overnight. TRM counts roughly USD 2.7 billion frozen onchain as of 00:30 UTC after coordinated actions by:
- Tether: roughly 1.77 billion USDT frozen across multiple attacker wallets.
- Circle: about 823 million USDC frozen.
- Ripple: 40.5 million RLUSD frozen.
- World Liberty Financial: 27.8 million USD1 frozen.
- Arbitrum Security Council: forced transfers removing 8,426 ETH and 74.6 million ARB from an attacker wallet.
Facing those freezes, the attacker raced to convert freezable stablecoins into assets beyond issuer control. About 325 million USDT was sold to market makers and solvers via intent-based contracts (UniswapX and similar), yielding roughly 122,300 ETH at steep discounts. Another 60 million USDT was supplied to Aave to borrow around 19,760 ETH before markets were frozen; on Tron, hundreds of millions of USDT moved into lending protocols, some of which were later frozen. After early conversions and the Bitcoin peel chain, TRM estimates the attacker still controls more than 420,000 ETH and 18,270 BTC—approximately USD 2.4 billion in assets outside issuer reach.
Laundering risks and expected next moves
With funds consolidated in a few wallets and the Bitcoin peel chain underway, TRM expects typical post-heist laundering channels to appear: cross-chain bridges, swap services, OTC brokers and market-maker fills. TRM is monitoring consolidation outputs and peel-chain transactions and alerting partners through the Beacon Network so exchanges and compliance teams can block or flag tainted deposits.
Practical steps for exchanges and compliance teams
– Screen deposits and counterparties against the attacker addresses TRM has labeled; funds from the BTC peel chain and ETH consolidation wallets are likely to arrive at centralized exchanges and OTC desks.
– Monitor for EIP-7702 delegations on Ethereum-compatible wallets. Delegations show up as code at addresses that normally would not host contracts; any unexpected delegation should trigger an immediate alert and a tested revocation procedure.
– Harden signing policies: reject EIP-7702 authorizations unless they are explicitly expected. Treat requests for many authorizations across consecutive nonces as an indicator of compromise.
– Separate signing infrastructure and approval paths by chain and wallet tier to reduce single-point failures.
– Market makers and solvers should perform real-time address screening before filling large orders; some early conversion attempts would have been flagged by such screening.
What happened to Binance, and how this stacks up
Binance confirmed a security incident on October 29 and temporarily suspended withdrawals on several networks. At an estimated USD 6.36 billion, this is the largest crypto theft on record—roughly four times the USD 1.5 billion Bybit hack in February 2025. Despite rapid freezes that secured about USD 2.7 billion, the attacker still controls a substantial pool of assets that remain difficult or impossible for issuers to recover onchain.
Closing thoughts
This incident highlights a new class of risk: compromises of signing infrastructure that can produce valid signatures across chains, combined with protocol-level delegation mechanisms like EIP-7702 that can be abused to turn hot wallets into sweepers. Rapid coordination among issuers, exchanges and network councils limited some damage, but the attacker’s conversion and consolidation strategies preserved a large residual value. TRM continues to track the attacker’s movements and share intelligence; exchanges and compliance teams should act quickly to implement screening and hardening measures.
Licensed under CC BY-ND 4.0 International