Binance Loses $6.3 Billion. Most Vanishes in 20 Minutes.

Analysis

North Korea's TraderTraitor hacking operation moved approximately $6.36 billion out of Binance wallets on October 29, with most of the theft occurring in about 20 minutes. That is roughly 19% of North Korea's estimated annual national income—an extraordinary amount for one cyber operation. The episode may also prove consequential for a different reason: digital-dollar issuers were able to freeze billions of dollars of stolen assets, while native cryptocurrencies remained outside their control.

Brief

October 31 update: The FBI now identifies TraderTraitor as responsible. Binance reports 90% of stolen value replenished, not 90% recovered from the hackers. It targets November 1 for withdrawals and November 3 for its full cryptographic reserves proof.

Binance confirmed an estimated $6.3 billion security incident on October 30. The exchange says its initial investigation points to a compromised DevOps engineer's laptop that allowed unauthorized withdrawals. It temporarily suspended withdrawals for security checks, found no evidence that wallet private keys leaked, and pledged to cover losses with its user-protection fund and company resources.

TRM Labs traced $6.36 billion across ten blockchains and attributes the attack with high confidence to TraderTraitor, a North Korea-linked hacking group. The total includes Bitcoin, Ether, XRP and dollar stablecoins. Most of the outflow happened within about 20 minutes; additional transfers followed.

Binance says approximately $3 billion in affected assets has been frozen. Tether, Circle, Ripple and other issuers could halt movement of their own tokens. Nobody at those companies can similarly freeze native Bitcoin or XRP. That distinction is now at the center of the industry's response.

Standard

Latest recovery: Binance says it is using treasury resources, its user-protection fund and part of its futures insurance fund to replace losses. Customer holdings of ten major tokens, including XRP and RLUSD, are reported fully backed. The company is still sourcing less-liquid tokens to cover the final 10%; the full cryptographic reserve proof remains pending. This is separate from the freeze-and-recovery operation against the hackers.

A crypto exchange is a financial institution with wallets, software, employees and transaction-approval systems. The blockchains can work exactly as intended while an attacker compromises the institution authorized to move its customers' assets. That appears to be what happened at Binance.

In its October 30 incident statement , Binance said a DevOps engineer's laptop may have been compromised, allowing an attacker to access a service container and initiate unauthorized withdrawals. The exchange says it has not found evidence of a private-key leak and will publish a technical post-mortem.

TRM's forensic reconstruction shows just how broad the compromise became: withdrawals across ten blockchains, including 18,270 BTC and 233.46 million XRP, with most of the $6.36 billion stolen in a 20-minute burst. TRM attributes the operation to North Korea's TraderTraitor group with high confidence. The FBI independently attributed the theft to TraderTraitor on October 31.

For perspective, the Bank of Korea estimates North Korea's entire 2025 nominal gross national income at 48.5 trillion won, approximately $33.8 billion. The value taken from Binance equals about 19% of that annual figure. National income measures the economic output and income of a country, not money deposited into its government's treasury; the comparison conveys the operation's scale rather than the amount Pyongyang can necessarily spend.

Why would a state invest so heavily in this capability? North Korea has spent decades under sanctions and severe limits on normal access to international finance. That makes portable, dollar-denominated value especially attractive. The U.S. Treasury says North Korean cybercrime and overseas IT worker schemes provide revenue for the regime's weapons programs. A joint U.S.–Japan–South Korea warning described systematic attacks on crypto exchanges and custodians. The incentive is not just criminal profit; for a sanctioned government, stolen digital assets can become a channel to scarce foreign currency and goods. The FBI's October 31 alert now publicly attributes this attack to North Korea's TraderTraitor operation; the FBI also observed attempts to convert stolen assets into Ether.

The hack also sent a shock through leveraged crypto markets. CoinGlass liquidation data reported by market observers placed forced futures closures around $1.5–$1.6 billion during the initial selloff. Liquidations can amplify a sudden price decline as exchanges close leveraged long positions and generate further selling. A 50-week moving-average retest visible in contemporaneous total-crypto-market charts is a useful technical reference, not evidence of a coordinated attack or proof that prices have reached a bottom.

The defensive response has been almost as revealing as the theft. TRM documented coordinated asset freezes by Tether, Circle, Ripple and World Liberty Financial, plus intervention by Arbitrum's Security Council. TRM counted about $2.7 billion frozen at its initial forensic cutoff; Binance later reported approximately $3 billion. Freezing an asset prevents further transfer under that token or network's rules. It is not yet the same as returning it to Binance.

Detailed

The speed was remarkable, but so was the reach. The attacker appears to have obtained the ability to persuade Binance's wallet-signing system to authorize withdrawals on multiple networks. A hot wallet is an internet-connected wallet used to process transactions. Its security depends not only on the blockchain but also on the controls determining which transactions it will sign.

TRM found that an Ethereum mechanism known as EIP-7702 helped the attacker delegate control of one Binance hot wallet to attacker-controlled code. The investigator traced a batch of 50 pre-signed authorizations followed by repeated sweeps of the wallet as funds arrived. Other compromised wallets on the Bitcoin, XRP Ledger, Solana, Tron and additional networks sent funds through ordinary valid signatures. That cross-chain pattern points toward a failure in centralized signing infrastructure, although Binance has not yet completed its root-cause analysis.

The reported amount dwarfs the $1.5 billion Bybit attack in February 2025. The FBI attributed the Bybit attack to North Korea's TraderTraitor operation. The FBI has now publicly attributed the Binance theft to that same group. The pattern matters: a sanctioned country with constrained access to foreign currency has developed an industrial-scale ability to acquire transferable assets from overseas targets. The U.S. Treasury has explicitly described how cybercrime proceeds are laundered to help finance North Korean weapons development. On this occasion, the $6.36 billion initial figure spans assets with radically different rules for intervention.

Dollar stablecoins such as USDT, USDC and RLUSD are issued by identifiable organizations. Those issuers can prohibit specific addresses from transferring their tokens under their contracts or ledger controls. TRM's investigation documents Tether freezing USDT, Circle freezing USDC and Ripple freezing 40.5 million RLUSD remaining in an attacker-controlled wallet. It also reports that Arbitrum's Security Council intervened to secure 8,426 ETH and 74.6 million ARB on Arbitrum. The power to intervene exists at different layers; the underlying native Ethereum network did not freeze ETH globally.

By contrast, Tether cannot put a freeze on native Bitcoin, and Ripple cannot freeze native XRP by exercising its RLUSD issuer powers. The stolen BTC and XRP were moved through exchange-controlled wallets, but their blockchains were not themselves breached. TRM reports that the attacker tried to convert freezable stablecoins into other assets before freezes could take effect.

The causal chain.

A compromised device may have opened a path into Binance's transaction infrastructure. Unauthorized signatures then permitted valid blockchain transfers. Issuer-controlled tokens could be frozen after the transfers, while native decentralized assets remained movable. The result is a large custody-security failure partially contained by a set of centralized emergency controls.

Those controls pose an important question for institutional finance: how much power to reverse, halt or recover a transaction should sit with the issuer, the network, the custodian or the courts?

The answer has consequences beyond crypto exchanges. Tokenized deposits, securities and stablecoin payments may adopt different combinations of permissioned validation, issuer controls and irreversible settlement. Banks will value theft containment and legal recovery. Users will also need protection against erroneous freezes and excessive intervention.

What happens next.

On October 31, Binance said it had replenished approximately 90% of the stolen assets through company resources, including its corporate treasury and portions of its SAFU and futures insurance funds. It reported full backing for customer balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, while the remaining approximately 10% involves less-liquid assets. That is Binance's replenishment claim, separate from the approximately $3 billion of stolen assets that partners have frozen. Binance expects withdrawals to resume on November 1, subject to security checks; the cryptographic proof behind its new reserve snapshot is targeted for November 3. The tests now are measurable: independently verified reserves, restored withdrawals, intact replacement signing controls and actual recovery of stolen assets.

The earlier forensic assessment has also become an official attribution: the FBI named TraderTraitor as responsible on October 31.

This is not evidence that Bitcoin, Ethereum or the XRP Ledger's consensus mechanisms failed. It is evidence that the systems holding and moving assets on behalf of customers can fail catastrophically—even when the underlying networks continue operating.

And the counterattack leaves a difficult but productive lesson: the ability to stop stolen money is valuable precisely because it introduces someone with the authority to stop it.

Primary sources

Binance: Security Incident Update , October 30, 2026.

Binance: 90% asset replenishment and reserves snapshot , October 31, 2026.

FBI: North Korea responsible for Binance attack , October 31, 2026.

CoinGlass: Liquidations market data , accessed October 31, 2026.

TRM Labs: North Korea Steals USD 6.36 Billion From Binance , on-chain forensic report, October 30, 2026.

Bank of Korea: North Korean GDP and GNI statistics , 2025 figures released July 31, 2026.

U.S. Treasury: DPRK cybercrime proceeds and sanctions enforcement , November 4, 2025.

U.S., Japan, Republic of Korea: Joint warning on DPRK cryptocurrency thefts , January 14, 2025.

FBI: North Korea responsible for Bybit cryptocurrency theft , February 26, 2025.