The largest theft in history: North Korea likely behind the $6.4 billion Binance hack

Last updated: 30 October 2026, 08:00 UTC. This is a rapidly evolving situation, and we will update this article with our latest findings.

Elliptic's analysis shows that $6.43 billion in cryptoassets was stolen from Binance on 29 October 2026, more than four times the $1.46 billion stolen from Bybit in 2025.

This is almost certainly the largest theft of any kind in history.

Binance says the breach began with a compromised DevOps engineer's laptop, and that no private keys were leaked.

Elliptic has verified $2.84 billion of frozen funds, 44% of the theft, almost all of it USDT and USDC. The attacker is swapping the rest into ETH and other assets that cannot be frozen.

Based on the evidence, Elliptic has attributed this theft to DPRK. Elliptic has confirmed that some of the stolen funds have reached the same address as proceeds of the suspected DPRK exploit of Bitget.

The attack is consistent with the methods of TraderTraitor, a DPRK hacking group associated with the Lazarus Group.

Elliptic has attributed addresses associated with the theft, and customers can screen against them now.

On 29 October 2026, $6.43 billion in cryptoassets were stolen from Binance, the world's largest cryptoasset exchange, according to Elliptic's analysis. Binance has estimated the impact at around $6.3 billion. Over the course of a few hours, the attacker drained Binance hot wallets across 11 blockchains.

This is by far the largest crypto heist of all time. It dwarfs the $1.46 billion stolen from Bybit in February 2025, which was itself more than twice the size of any crypto theft . In fact, this incident is almost certainly the single largest known theft of any kind. Before Bybit, that record was held by Saddam Hussein, who took $1 billion from the Central Bank of Iraq in Baghdad on the eve of the 2003 Iraq War. The Binance theft is more than six times larger.

Based on the evidence available, Elliptic has attributed the theft to DPRK. If so, this single incident would almost double the total cryptoassets stolen by the regime. DPRK-linked actors are believed to have stolen over $6.5 billion in cryptoassets in recent years, including more than $1 billion tracked by Elliptic in 2026 before this incident. The US government has linked these thefts to the funding of North Korea's weapons programs.

How did the Binance attack unfold?

At approximately 20:05 UTC on 29 October, five Binance wallets on the XRP Ledger sent 233 million XRP to a single attacker-controlled address. Over the 30 minutes, Binance hot wallets on Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum and Avalanche were also drained. A second wave of withdrawals hit Binance wallets on Avalanche and Polygon shortly after 23:00 UTC.

The largest losses were on Ethereum, where $3.80 billion was taken across 186 different tokens, including 1.9 billion USDT and 823 million USDC. The attacker also stole 18,270 BTC, worth $1.48 billion, and 612.7 million USDT on Tron. Binance has suspended deposits and withdrawals, and has said that it will cover all losses using its SAFU fund and company funds.

Four assets made up 74% of the theft: USDT on Ethereum, BTC, USDC and USDT on Tron. Two-thirds of the Ethereum losses, $2.53 billion, left in a single transaction at 20:24 UTC. Elliptic's total excludes a further $169 million that left Binance after withdrawals were suspended. This went to long-established addresses with no link to the attacker, and appears to be Binance moving its own funds.

Binance's initial investigation suggests that the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions". Binance says it has found no evidence of a private key leak, and will publish a detailed technical post-mortem once its investigation is complete.

The on-chain evidence is consistent with this account. Rather than stealing Binance's private keys, the attacker appears to have been able to get Binance's own systems to sign transactions on their behalf:

Preparation: On 28 October, an attacker-controlled wallet received three small withdrawals from the Tornado Cash mixer. The following day, the code used in the attack was tested on two wallets and rehearsed on a third, around four hours before it was deployed against Binance.

EIP-7702 delegation: On Ethereum, the attacker abused EIP-7702, a feature introduced in the 2025 Pectra upgrade that allows a regular wallet to delegate its behaviour to a smart contract. The attacker submitted 50 pre-signed authorizations, each covering a different nonce, ensuring that one would be valid. This delegated control of a Binance hot wallet to a "sweeper" contract controlled by the attacker, which emptied it of 167,464 ETH and 1.6 billion USDT.

Persistent access: The delegation remained in place after the initial theft, allowing the attacker to sweep new deposits into the wallet at least six more times over the following three and a half hours.

Other blockchains: On the ten other affected blockchains, funds were sent from Binance wallets in ordinary signed transactions. On Ethereum, a second Binance hot wallet also signed nine transfers worth $174 million directly to the attacker. This suggests the attacker was able to instruct Binance's signing infrastructure directly.

This closely resembles the Bybit theft, in which North Korean hackers compromised a developer's machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved. In both cases, it was the infrastructure and people around the wallets that were compromised, not the cryptography.

Following the stolen funds

The first step in laundering stolen cryptoassets is typically to exchange any tokens for a "native" blockchain asset such as Ether or Bitcoin. This is because tokens have issuers who can in some cases freeze wallets containing stolen assets, whereas there is no central party who can freeze Ether or Bitcoin.

Stablecoins made up $3.46 billion of the stolen funds, and the attacker was slow to convert them. The stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC. Tether froze that wallet 37 minutes later, locking 1.18 billion USDT in place, and then followed the funds, freezing four more attacker addresses within 17 minutes. Circle froze the 823 million USDC in the same wallet three minutes after that. Ripple, World Liberty Financial, Paxos and First Digital froze further stablecoins, Tether froze tokenised gold, Binance froze the WBETH it issues, and the Arbitrum Security Council took emergency action to move assets out of the attacker's reach. In total, Elliptic has verified $2.84 billion of frozen funds on-chain, close to Binance's estimate of around $3 billion.

Stablecoins make up 94% of the frozen funds, almost entirely on Ethereum and Tron. Arbitrum is the only blockchain where almost everything stolen has been secured. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because native assets have no issuer that can freeze them. Ripple, for example, can freeze RLUSD but not XRP. Aave froze its markets, but this blocked new activity rather than seizing any of the attacker's funds.

Before the freezes landed, the attacker converted around $786 million of stablecoins into ETH and TRX. They have also been working to convert and move the remaining funds:

Stablecoin swaps: On Ethereum, 434 million USDT was swapped for 160,451 ETH through Uniswap, 1inch and market makers' request-for-quote systems. The swaps implied a loss of 12% to 26% against the market price, suggesting the attacker was prioritising speed over value.

DeFi lending: A second attacker wallet deposited 59.9 million USDT into Aave as collateral and borrowed 19,762 ETH, before Aave froze the affected markets.

DEX trading: On Tron, 234 million USDT was swapped for 638 million TRX on SunSwap. On Ethereum, 48 million RLUSD was sold before Ripple froze the remainder, and around 150 other tokens have been dumped for ETH on decentralised exchanges.

Bitcoin: The 18,270 BTC has been split through a short peel chain into 19 addresses, most holding 1,000 BTC each. None of it has yet been sent to a service.

Cross-chain activity: Almost none of the stolen funds have yet reached a cross-chain bridge, mixer or exchange. The exception is around $1.9 million of TRX, some of which has been sent through THORChain. Elliptic has confirmed that some of these funds have reached an address that also received proceeds of the September 2026 exploit of Bitget, as first reported by ZachXBT.

At current prices, the attacker now controls around $3.33 billion of assets that cannot be frozen by an issuer, spread across around 43 addresses. This includes 511,861 ETH ($1.15 billion), 18,270 BTC ($1.43 billion), 233 million XRP and 670 million TRX. The XRP, SOL and NEAR, worth around $445 million, have not moved at all since they were stolen. Based on the laundering of the Bybit funds , we expect these assets to be layered through many wallets, cross-chain bridges, mixers and swap services, before attempts are made to cash them out through OTC brokers and exchanges.

Was North Korea responsible?

Based on the evidence available, Elliptic has attributed the theft to DPRK. Our own analysis has confirmed the most significant on-chain link reported so far. The attack is consistent with the methods of TraderTraitor, a DPRK hacking group associated with the Lazarus Group, which has been linked to the Bitget exploit. No government or law enforcement agency has confirmed attribution, and Binance has not commented on who was responsible.

The following factors point to DPRK involvement:

Infrastructure overlap: Elliptic's analysis confirms that funds stolen from Binance and funds linked to the Bitget exploit have been sent to the same Ethereum address, 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7, as first reported by ZachXBT. The Binance funds left an exploit address on Tron, passed through a peel chain of around 28 hops, and were then moved to Ethereum through THORChain and the Hyperlane bridge. Elliptic assessed the Bitget exploit as highly likely to be DPRK-linked, and shared laundering infrastructure between incidents is a recurring feature of DPRK-attributed hacks.

Attack preparation: The attacker funded their wallet with three small Tornado Cash withdrawals, tested and rehearsed the attack code well in advance, and executed pre-signed transactions in a single burst. The same pattern was seen in the Bybit and KelpDAO exploits.

Targeting of staff: Binance says the attack began with a compromised engineer's laptop. The FBI has warned that TraderTraitor targets employees of crypto businesses through social engineering, such as the fake recruitment coding test used in the 2024 theft from DMM Bitcoin. The same route was used in the Bybit hack.

Capability: Coordinated drains across 11 blockchains, each with different wallet and signing systems, in around three hours. Very few actors could carry out an attack on this scale.

Precedent: The majority of the most significant centralised exchange and bridge hacks in recent years have been attributed to DPRK-linked actors, including Ronin Bridge (2022), Atomic Wallet (2023), WazirX (2024) and Bybit (2025).

However, there are still reasons for caution:

The overlap is small, and may point to a launderer: Only around $39,000 of the Binance funds have reached the shared address so far, compared with around $510,000 linked to Bitget. Professional laundering networks can serve more than one client. The overlap proves that the two thefts a laundering network, but not necessarily that they were carried out by the same hacker.

Laundering speed: DPRK launderers typically swap stolen stablecoins for native assets within minutes. In this case, more than $2.6 billion in stablecoins was still in the attacker's wallets when issuers froze them. The attacker held the stolen USDT for 37 minutes on Ethereum and 46 minutes on Tron without converting most of it. North Korean-linked groups typically move funds faster and more efficiently.

Laundering methodology: The use of market makers and DeFi lending protocols differs from the bridge-heavy laundering seen after the Bybit hack.

Root cause not yet published: How the engineer's laptop was first compromised is the most diagnostic fact still missing. Binance has not yet published its post-mortem.

No official attribution: The FBI attributed the Bybit hack to North Korea within five days. There has been no equivalent statement so far.

Taken together, Elliptic believes that DPRK actors perpetrated the Binance theft. Elliptic is now checking for further overlaps between the Binance funds and other DPRK-attributed thefts, including Bybit, KelpDAO and Drift . We will update this post as new information becomes available.

How Elliptic is supporting its customers

Beginning minutes after the theft, the Elliptic team has been working around the clock to trace the stolen funds across every affected blockchain. We have attributed addresses associated with the theft and are in close with Binance. We are urgently updating our datasets as the funds move, and customers using Elliptic solutions will see these addresses reflected in their screening, monitoring and investigation workflows.

This means that exchanges, financial institutions and other crypto businesses that use Elliptic will be alerted if they receive funds linked to the Binance theft, and can freeze them before they are cashed out. This approach has already proven effective. Following the Bybit hack, Elliptic labelled the first addresses linked to the theft within 18 minutes, and our real-time screening enabled an exchange to freeze and seize stolen funds as soon as they arrived. Investigators and law enforcement agencies can use Elliptic Investigator to follow the funds across blockchains, through bridges, swaps and mixers.

The laundering of the Bybit funds took months, and we expect the same here. Every step in that process is an opportunity to identify the funds and prevent them being cashed out. More than $3 billion of the stolen assets, including 233 million XRP sitting in a single address, can now only be stopped when they reach an exchange or other service. Elliptic will flag them as soon as they move.

Elliptic customers can screen against the addresses linked to this incident now. To find out how Elliptic's screening and investigation solutions can help your business, our team today.