Blockchain intelligence company TRM Labs says it traced approximately $6.36 billion in transfers from Binance-linked wallets on ten blockchains during the October 29 security incident. The firm attributes the activity with high confidence to TraderTraitor, a North Korea-linked hacking group, but that identification is an investigator judgment rather than a confirmed law-enforcement finding for this specific incident.
Evidence behind the estimate
In its October 29 blockchain investigation, TRM Labs said its $6.36 billion estimate valued assets at market prices when they left the affected wallets. Ethereum accounted for approximately $3.79 billion of the observed outflows, alongside transfers involving Bitcoin, Tron, the XRP Ledger and Solana. Those figures and the attacker attribution are TRM’s assessments, not a final public law-enforcement determination.
The investigator’s $6.36 billion on-chain valuation and Binance’s rounded $6.3 billion incident estimate use related but not necessarily identical methodologies. Frozen balances, price movements and later recovery may change the net exposure.
Why TRM points to TraderTraitor
The firm said the attack showed preparation, coordinated withdrawals across chains and behavior resembling earlier campaigns attributed to the group. TRM described its view as high confidence based on on-chain and off-chain intelligence.
Because the supporting off-chain intelligence is not wholly public, readers cannot independently reproduce the entire attribution from blockchain transactions alone. Binance said it is working with law enforcement to identify the attackers but did not endorse a named perpetrator in its October 30 statement. BlockBriefing’s report on Binance’s own disclosure covers the exchange’s preliminary account separately.
Ethereum delegation and hot-wallet access
TRM’s analysis describes an Ethereum EIP-7702 delegation that allowed a Binance hot wallet to execute an attacker-controlled sweeper contract. The firm reported that the operator submitted 50 pre-signed authorizations, with one becoming valid as the wallet’s transaction nonce advanced.
TRM also described ordinary signed transfers from wallets on other chains. Readers can learn how public transaction records are inspected in BlockBriefing’s blockchain explorer guide, while recognizing the limits of wallet attribution. It interpreted the cross-chain pattern as potential evidence of compromised signing infrastructure. That remains a hypothesis until Binance provides a technical post-mortem.
Frozen assets and outstanding risks
TRM estimated that stablecoin issuers and other blockchain participants had frozen about $2.7 billion as of its early October 30 snapshot, while Binance subsequently reported roughly $3 billion frozen. These totals reflect different reporting times and potentially different scopes.
An on-chain freeze does not by itself identify the attackers or return all assets. Further laundering, asset conversions and recovery actions could materially alter the figures. The investigation should be updated only when primary evidence changes.
Primary source and verification
Read the original announcement or data record for the underlying evidence. Figures and circumstances reflect the publication dates specified in this report and may change with subsequent disclosures.
BlockBriefing reports on digital assets for information, not as investment, legal or trading advice. Images created for this report are editorial illustrations, not documentation of the event.
