INVESTIGATION | October 31, 2026 (UTC). At approximately 20:05 UTC on October 29, unauthorized transactions began draining Binance-linked wallets. The transfers reached ten blockchain networks, and most of the roughly $6.36 billion identified by blockchain intelligence firm TRM Labs moved in about 20 minutes. What unfolded was not merely an unusually large theft: the pattern raises questions about the controls that authorize transactions at the world’s largest cryptocurrency exchange.
In its official security update, Binance acknowledges a roughly $6.3 billion loss and says it will use company and user-protection resources to cover affected balances. But crucial elements of the case remain unresolved: how attackers obtained the ability to authorize transfers across dissimilar networks, whether the same infrastructure was involved in every withdrawal, and how much of the frozen cryptocurrency can actually be recovered.
The verified facts — and the limits of what is known
Confirmed by Binance: unauthorized withdrawals began around 20:05 UTC on October 29; hot wallets were compromised; losses were about $6.3 billion; withdrawals were temporarily suspended; approximately $3 billion had been frozen on-chain by its October 30 update. Binance said it found no evidence at that stage that wallet private keys had leaked, although an initial theory involving a compromised laptop was no longer its only suspected intrusion point.
Independently assessed by TRM Labs: approximately $6.36 billion moved from Binance-attributed wallets across ten chains; the firm attributes responsibility with high confidence to the North Korea-linked TraderTraitor operation; 
Ethereum market price and chart transaction activity included a malicious EIP-7702 delegation and a group of 50 pre-signed authorizations. These are findings and assessments made by TRM, rather than conclusions Binance has independently confirmed in a published technical post-mortem.
Unconfirmed: the complete entry route, the identity of individual operators, whether any particular employee or third-party provider was responsible, the eventual recoverable value of frozen assets, and the final user reimbursement timeline. No public proof establishes that Binance’s entire wallet system was compromised or that customer balances will ultimately incur a loss.
A 20-minute attack spanning ten networks
TRM’s transaction reconstruction describes an unusually coordinated sequence. On the 
XRP market price and chart Ledger, five wallets sent about 233.46 million XRP to an attacker address between 20:05 and 20:09 UTC. 
Solana market price and chart and Optimism market price and chart transactions followed soon after. At approximately 20:20 UTC, a Binance Bitcoin hot wallet transferred 18,270 BTC to an attacker-controlled address. Around two minutes later, a Tron hot wallet sent about 612.7 million USDT and 46.4 million TRX.
A second wave around 23:05 UTC involved Avalanche and Polygon. Overall, TRM counted ten affected networks: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
At theft-time valuations, TRM estimates roughly $3.79 billion departed on Ethereum and about $1.47 billion in Bitcoin. Its breakdown also includes approximately $628 million on Tron, $296 million on XRP Ledger, $96 million on Solana, about $39 million combined across Arbitrum, Optimism and Base, $28 million on Avalanche and $10 million on Polygon. These are estimates that depend on token prices and attribution; they should not be read as independently audited accounting totals.
What the Ethereum transactions reveal
The most technically distinctive component in TRM’s reconstruction concerns Ethereum Improvement Proposal 7702. The feature allows an externally owned account, after authorization, to execute delegated smart-contract functionality. It was not itself a defect or proof of a protocol exploit.
TRM says the attacker used delegated code to turn one Binance hot wallet into a sweeping mechanism, with 50 authorizations prepared ahead of time. Under that account, newly arriving assets could also be diverted. Separate wallets on Ethereum and other chains allegedly used standard validly signed transfers, rather than the same delegated-contract method.
This distinction matters. Ethereum smart-contract code cannot directly authorize Bitcoin and XRP Ledger transactions. The nearly simultaneous activity across different signing systems led TRM to assess that a broader signing or approval pathway was compromised. That is a plausible inference from the cross-chain pattern, not a confirmed root cause. Binance’s internal investigation could ultimately establish a different or more complex sequence.
Signs of preparation before the theft
TRM reports activity consistent with preparation at least 36 hours earlier. It identified three small Tornado Cash-funded transfers to an operator wallet beginning October 28, along with deployments and tests of attack-related code on October 29. According to the firm’s reconstruction, an apparent rehearsal preceded deployment against a Binance hot wallet by several hours.
These traces may help identify methods, but the mere use of Tornado Cash, an Ethereum privacy tool, cannot establish an actor’s nationality or identity. TRM says its TraderTraitor attribution draws on both on-chain and off-chain intelligence. Because the latter evidence is not fully public, independent readers cannot reproduce every step of that attribution from blockchain transactions alone.
North Korea allegation — compelling intelligence, not a verdict
TRM Labs attributes the Binance incident to TraderTraitor with high confidence and says the group also carried out the February 2025 Bybit breach. Its analysis cites similarities in staging, advance signatures and operational patterns, while acknowledging differences in subsequent laundering.
That assessment deserves serious consideration, given TRM’s specialized investigative role. Nevertheless, a company’s intelligence attribution is not equivalent to a criminal conviction or a new formal government attribution. Readers should distinguish the confirmed fact of unauthorized transfers from allegations about the perpetrator.
TRM’s broader research estimates that North Korea-linked actors stole $7.4 billion in 2026 through October 30, but that figure incorporates its own attribution of the Binance incident. It must not be presented as separate corroboration of the same attribution.
The $3 billion freeze and the $2.4 billion beyond issuer controls
The recovery picture has produced some of the most easily misunderstood headlines. Binance said roughly $3 billion had been frozen on-chain by its October 30 update. TRM separately reported approximately $2.67 billion in stablecoins frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, plus roughly $30 million of assets frozen through Arbitrum governance/security measures in its earlier snapshot. Different figures may reflect different times, classifications or subsequent actions.
Frozen does not mean returned. Issuer-level restrictions can prevent transfers of certain stablecoins, but ownership, legal process, contract controls and operational steps still determine whether assets can be restored. Nor does the remaining amount simply equal the total theft minus the issuer freezes: transactions, asset prices and the timing of snapshots complicate that calculation.
TRM estimated that the attacker still held more than 420,000 ETH and 18,270 BTC worth approximately $2.4 billion in assets that token issuers cannot unilaterally freeze. Bitcoin and native ether have no central stablecoin issuer with an equivalent blacklist function. Police action, exchange cooperation and tracing may nevertheless affect attempts to spend or convert those assets.
What Binance’s $6.34 billion promise actually covers
Binance said it allocated more than $6.34 billion of corporate and SAFU resources to absorb incident losses rather than passing them to users. Its October 30 statement said approximately $5 billion was already held in affected asset types, including BTC, ETH, USDT, USDC and BNB, equivalent to roughly 80% of the token-specific replacement goal. Binance said it was acquiring the remainder through market and over-the-counter channels.
These are Binance’s disclosures, not independent verification of complete reimbursement or restored liquidity. Its planned proof-of-reserves snapshot, expected to be available by November 2, is a relevant next test, but a reserve disclosure alone does not establish every liability, off-chain obligation, solvency risk or the details of the cyberattack. The exchange also said withdrawal services would be restored progressively after additional security checks, subject to operational verification.
For the earlier reimbursement announcement, see BlockBriefing’s report on Binance’s corporate funding commitments. For its initial asset-freeze disclosures, read Binance’s $6.3 billion security incident update.
Why the incident matters beyond Binance
The central security concern is concentration of transaction-approval authority. A crypto exchange may hold funds on multiple networks, but the operational systems that prepare, approve and broadcast transactions can be more interconnected than their underlying blockchains. A single trust-boundary failure could therefore have consequences across chains — although no evidence yet establishes which particular boundary failed here.
Potential safeguards include segregated signing environments, hardware-backed key handling, separation of duties, transaction policy engines, withdrawal velocity limits and independent monitoring. None can be described as a proven fix for this attack until the root cause is known. A key operational question is whether attackers could initiate transfers, obtain valid signatures, bypass approval policy or combine several of those capabilities.
TRM’s analysis also describes interactions with liquidity venues and decentralized finance protocols while issuers worked to freeze tokens. For context on market infrastructure risks, BlockBriefing reported that Aave froze 292 reserves during the response. Read our separate report on how other exchanges responded to the breach.
Five unanswered questions investigators must address
- Entry point: What system or account was initially compromised, and how many additional points of entry were established?
- Signing authority: How were valid authorizations produced across different chains and transaction types?
- Controls: Which safeguards failed, were bypassed or failed to detect unusual cross-chain withdrawal activity?
- Funds: Exactly which tokens were frozen, at what times, and what proportion has been legally and technically recovered?
- Accountability: What independently reviewable evidence supports the perpetrator attribution, and when will Binance release a complete technical post-mortem?
Our findings
The theft’s scale is extraordinary, but its most consequential feature may be its coordination across different blockchain systems. TRM’s reconstruction points toward access to a shared transaction-authorization process. Binance confirms a catastrophic hot-wallet incident but has not yet verified that technical explanation publicly.
The public record supports reporting of a $6.3 billion incident, billions in subsequent issuer freezes and a substantial replenishment commitment. It does not yet justify a definitive claim that private keys were leaked, a specific employee was responsible, stolen funds have all been recovered, or a particular nation-state’s responsibility is conclusively established.
Primary documents and investigation sources
- Binance, Security Incident Update #2, October 30, 2026 — incident chronology, resource allocation, freezing and withdrawal updates.
- TRM Labs, October 29–30 forensic reconstruction — cross-chain transactions, EIP-7702 analysis, attacker-fund tracking and group attribution.
- TRM Labs, October 30 threat landscape analysis — methodology and wider historical context.
- Ethereum EIP-7702 specification — technical basis for understanding delegated-account functionality.
Editorial methodology: This investigation compares Binance’s first-party disclosures with TRM Labs’ specialist forensic work, identifies where their claims differ in scope or timestamp, and distinguishes confirmed transactions from attribution and root-cause hypotheses. It does not represent an independent on-chain audit or a completed signed human fact-check. Figures and findings reflect available information as of October 31, 2026 (UTC), and may change as further evidence is published.
