TRM says Binance crypto hack stole $6.36B across 10 chains, mostly in 20 minutes

What it is

On 29 October 2026, starting 20:05 UTC, an attacker drained Binance hot wallets on ten chains. TRM Labs valued the loss at USD 6.36 billion, using prices at the time of each transfer. That is about four times the USD 1.5 billion Bybit theft of February 2025. TRM attributes it with high confidence to TraderTraitor, a North Korean state-sponsored unit. Chainalysis CEO Jonathan Levin separately assessed that TraderTraitor likely carried it out.

How it works

The Ethereum leg used EIP-7702, which lets an ordinary wallet authorize a smart contract to govern its behavior.

• At 20:20 UTC the operator submitted 50 pre-signed authorizations covering consecutive transaction counts.
• One matched the hot wallet's current count and activated a sweeper contract that accepted only the operator's instructions.
• After 3 minutes 24 seconds, one sweep moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
• The delegation stayed active, so six more sweeps captured later deposits.
• The wallet also controlled a separate smart account holding 823 million USDC, which Circle froze.

Other chains used ordinary signed transfers. TRM's assessment is that the attacker likely reached Binance's hot wallet signing infrastructure across chains. Binance first pointed to a compromised laptop and later found additional breach points. TRM traced preparation back at least 36 hours: small Tornado Cash withdrawals, deployed attack code and rehearsals.

Preconditions / Affected

The losses by chain were:

• Ethereum: USD 3.79 billion (200,630 ETH plus 185 other tokens).
• Bitcoin: 18,270 BTC, about USD 1.47 billion.
• Tron: USD 628 million.
• XRP Ledger: USD 296 million.
• Solana: USD 96 million.
• Arbitrum, Optimism and Base combined: about USD 39 million.
• Avalanche: about USD 28 million.
• Polygon: about USD 10 million.

A second wave reached Avalanche and Polygon around 23:05 UTC. The page does not say how the signing infrastructure was breached.

What to do

TRM recommends four controls:

• Screen deposits and counterparties against the identified attacker addresses.
• Monitor treasury wallets for unexpected EIP-7702 delegations.
• Reject unanticipated authorizations.
• Separate signing infrastructure by chain and wallet tier.

The page gives no detection queries or commands.

Caveats

• Freezes cover only part of the loss. TRM counted about USD 2.7 billion frozen by 00:30 UTC on 30 October, and Binance later said about USD 3 billion. Tether froze about 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD and World Liberty Financial 27.8 million USD1. Arbitrum's Security Council removed 8,426 ETH and 74.6 million ARB from the attacker.
• About USD 2.4 billion (over 420,000 ETH and the 18,270 BTC) sits beyond issuer freezing powers. The Bitcoin was split through peel chains to hinder tracing.
• The attacker sold about 325 million USDT for roughly 122,300 ETH. It also deposited 60 million USDT into Aave and borrowed about 19,760 ETH, after which Aave froze the affected markets.
• Frozen funds still need legal recovery. TRM's Ari Redbord said this requires proceedings, and Chainalysis's Eric Jardine said returns can take months or years.
• Binance says user funds are safe and has reserved over USD 6.3 billion. USD 5 billion of replacement reserves already matched the affected tokens, and purchases of the rest were underway.