# Binance multi-chain hack (TraderTraitor-linked): Binance loses a reported ~$6.3B across 10 chains; TRM Labs links theft to North Korea's TraderTraitor
Source page: https://vaultx.llc/hacks/binance-hack-october-2026 · VaultX incident report by Sentinel · first published 2026-10-30, updated 2026-10-31
- Date: 2026-10-29
- Reported loss: $6.30B (Reported about $6.3B by most outlets; TRM Labs reportedly estimated ~$6.36B moved out of Binance wallets; Chainalysis was cited at ~$5.9B at the time of theft. Not independently verified. About $3B is reportedly frozen, but that figure is unclear.)
- Attribution: North Korea's TraderTraitor group. TRM Labs said it has 'high confidence', based on 'robust on- and off-chain intelligence'. Chainalysis and ZachXBT were also reported to link the incident to the same actor. Binance has not publicly confirmed a final attribution.
- Chains: 10 blockchains (full list not published in the available reporting), Bitcoin, THORChain (routing, reportedly)
- Status: developing
- Severity: 96/100
- Response score: 72/100 (Fast public acknowledgment, a withdrawal halt, freeze coordination, a pledge to cover all losses and a preliminary root cause; but final figures, the post-mortem and the recovery amount are still missing.)
Binance disclosed a security incident on Oct. 29, 2026. Reports put the loss at about $6.3B, taken from wallets on 10 blockchains, mostly within about 20 minutes. Binance's preliminary findings reportedly point to a compromised DevOps engineer's laptop used to authorize withdrawals, with no evidence of a private-key leak. TRM Labs attributes the theft to North Korea's TraderTraitor with high confidence. Binance suspended withdrawals and deposits, says user funds are safe, and has pledged to cover all losses.

**What happened**
Binance publicly acknowledged a 'security incident' on Oct. 29, 2026. According to TRM Labs, the attacker moved funds out of Binance wallets on 10 blockchains, with most of the activity in about 20 minutes. One report mentions a second wave about three hours later.
Most outlets put the loss at about $6.3B. TRM Labs reportedly estimated about $6.36B, and Chainalysis was cited at about $5.9B at the time of the theft. The totals differ and none is confirmed by Binance in the material available.
According to CoinDesk, the attacker drained 18,270 BTC (about $1.4B at early Friday prices) and split it into 19 wallets. Seventeen wallets reportedly hold exactly 1,000 BTC each, one holds 832.5 BTC and one holds 437.7 BTC. The coins had reportedly not moved again as of early Friday.
Binance reportedly said user funds are safe, temporarily suspended withdrawals and deposits, and worked with partners to freeze affected assets. Some coverage says withdrawals could resume within about 48 hours, after a security revamp and a technical post-mortem.

**How it worked**
According to Binance's reported preliminary findings, attackers appear to have compromised a laptop belonging to a DevOps engineer. They then used that access to submit unauthorized withdrawal transactions. Binance reportedly said there was no evidence of a wallet private-key leak. This is an initial finding, not a final post-mortem.
After the theft, the BTC was fragmented into 19 wallets within minutes, likely to hinder freezing and tracing, according to the reporting. Investigators reportedly linked part of the flow to THORChain routing. Some reports say the stolen funds were commingled at the same address with funds from an earlier Bitget exploit. How the attackers first compromised the laptop has not been published.

**Where the money went**
Reported flows: funds left Binance wallets on 10 chains and the stolen BTC (18,270 BTC) sits in 19 wallets, idle as of early Friday per CoinDesk. Investigators reportedly linked part of the flow to THORChain, and some reports say it was commingled with earlier Bitget exploit funds. No named mixer or confirmed exchange destination appears in the available reporting. A reported ~$3B is frozen, but the sources do not cleanly separate Binance-specific freezes from ecosystem-wide defensive freezes (Aave on Avalanche, $30.5M locked on Arbitrum), so treat that figure cautiously. The amount actually recovered is unknown.

**The response**
Binance reportedly said user funds are safe, suspended withdrawals and deposits, and worked with partners to freeze affected assets. It pledged to cover all losses from its SAFU/emergency fund and company funds, and said it engaged law enforcement and blockchain intelligence partners. It also reportedly plans a security revamp and technical post-mortem, with withdrawals possibly resuming within about 48 hours. No regulator order or police action was identified in the available coverage.

**Impact**
The hack was described as a major shock to crypto markets and, in one outlet's phrasing, the 'largest bank heist in human history'. Bitcoin reportedly slid below $77,000 per The National, though no verified price move is available. Binance users face suspended withdrawals and deposits, though the exchange says funds are safe and losses will be covered. Contagion reportedly reached beyond Binance: the headline coverage says India's largest crypto exchange curbed futures trading, Aave froze Avalanche markets and Arbitrum locked $30.5M.

**Wallets linked to this case**
- 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 (Ethereum (presumed from the EIP-7702 context; chain not explicit in the source), attacker (operator wallet, per Odaily)) source: https://www.odaily.news/en/post/5213666
- 0x63e842B054Bd624a465454D533C33F573e9c6fAe (Ethereum (presumed from the EIP-7702 context; chain not explicit in the source), attacker (sweeper contract, per Odaily)) source: https://www.odaily.news/en/post/5213666

**Timeline**
- 2026-10-29 Binance publicly acknowledges a 'security incident'; withdrawals and deposits reportedly suspended.
- 2026-10-29 According to TRM Labs, funds leave Binance wallets on 10 blockchains, mostly within about 20 minutes. One report mentions a second wave about three hours later.
- 2026-10-30 CoinDesk reports 18,270 BTC split across 19 wallets that had not moved again.
- 2026-10-30 TRM Labs attributes the theft to North Korea's TraderTraitor with 'high confidence'; Chainalysis and ZachXBT reportedly link it to the same actor.
- 2026-10-30 Reports say about $3B has been frozen, Aave froze Avalanche markets and Arbitrum locked $30.5M (reported, unclear how much is Binance-specific). Binance reportedly says withdrawals may resume within ~48 hours and pledges to cover losses.
- 2026-10-30 Bitcoin reportedly slides below $77,000 as the hack rattles markets; an Indian exchange reportedly curbs futures trading.

**How to protect yourself**
- Endpoint compromise of privileged staff (DevOps laptops) can bypass strong wallet security. Builders should enforce hardware-isolated signing, multi-party approval and withdrawal limits that do not depend on a single workstation.
- Withdrawal anomaly detection and rapid circuit breakers matter when most funds move within about 20 minutes.
- Users should treat exchange balances as counterparty risk: hold only what you need for trading, use self-custody for long-term holdings, and stay alert to phishing that exploits the news.
- Rely only on Binance's official channels for withdrawal-resumption updates, and do not click on 'compensation' or 'recovery' links.
- Counterparty exposure spreads. Protocols and exchanges should have emergency freeze procedures and information-sharing with analytics firms.

**Still unknown**
- Exact total loss ($5.9B, $6.3B or $6.36B) and a full breakdown by asset and chain.
- How much is actually frozen or recoverable; the ~$3B figure is unclear and may include ecosystem-wide freezes.
- How the DevOps laptop was compromised and whether other systems or insiders were involved; Binance's post-mortem is pending.
- Full list of attacker wallet addresses; none were published in the available reporting.
- Whether Binance will formally confirm the North Korea/TraderTraitor attribution.
- Details of any regulatory or law-enforcement action.
- Exact timing of the withdrawal resumption and the size of the exchange's reserve cover.

**Sources**
- CoinDesk: Binance hacker splits $1.4 billion of bitcoin into 19 wallets that no one can freeze https://www.coindesk.com/markets/2026/10/30/binance-hacker-splits-usd1-4-billion-of-bitcoin-into-19-wallets-that-no-one-can-freeze
- UPI: Binance North Korea theft https://www.upi.com/Top_News/World-News/2026/10/30/Binance-North-Korea-theft/8961793332095/
- CNBC: Billions in crypto frozen in Binance hack https://www.cnbc.com/2026/10/30/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next-.html
- Cointelegraph live updates: Binance losses estimated at $6.3B https://cointelegraph.com/news/live-updates-binance-losses-estimated-at-6-3b-amid-major-crypto-hack
- Cointelegraph: North Korea linked to $6.3B Binance hack by crypto investigators https://cointelegraph.com/news/north-korea-linked-to-63b-binance-hack-by-crypto-investigators
- Yahoo/Reuters: Blockchain analysis firm TRM says... https://sg.news.yahoo.com/blockchain-analysis-firm-trm-says-042607296.html
- The National: Bitcoin slides below $77,000 as Binance hack rattles crypto markets https://www.thenationalnews.com/business/markets/2026/10/30/bitcoin-slides-below-77000-as-binance-hack-rattles-crypto-markets/
- BusinessDay: Binance freezes $3bn after massive multi-chain breach https://businessday.ng/technology/article/binance-freezes-3bn-after-massive-multi-chain-breach/?amp
- CyberInsider: Binance security incident $6.3 billion https://cyberinsider.com/binance-security-incident-6-3-billion/
- Hindustan Times: North Korea behind $6.3 billion Binance crypto theft, TRM says https://www.hindustantimes.com/world-news/north-korea-behind-6-3-billion-binance-crypto-theft-blockchain-analysis-firm-trm-says-101793336395870-amp.html
- LCX live updates: Binance eyes withdrawal restart within 48 hours https://lcx.com/en/cryptonews/live-updates-binance-eyes-withdrawal-restart-within-48-hours-after-63b-hack
- Crypto Times: Aave freezes Avalanche markets, Arbitrum locks $30.5M https://www.cryptotimes.io/2026/10/30/binance-hack-aave-freezes-avalanche-markets-arbitrum-locks-30-5m-as-3b-frozen-in-record-6-3b-exploit/
- Cointelegraph: What happened in crypto today https://cointelegraph.com/news/what-happened-in-crypto-today
- TRM Labs: North Korea steals $6.36 billion from Binance https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
- Blockaid: Binance $5.5B hack https://blockaid.io/blog/binance-55b-hack-using-advanced-ai-models-blockaid-detects-the-biggest-theft-in-crypto-history
- Binance Square timeline post https://www.binance.com/en/square/post/382685627573522
- Binance Square post (receiving address) https://www.binance.com/en/square/post/382660804030929
- Binance Square post (EIP-7702 flow) https://www.binance.com/en-TR/square/post/382663108475366
- Aave governance: response to Binance hot wallet exploit https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954
- Odaily: operator wallet and sweeper contract https://www.odaily.news/en/post/5213666

---
VaultX: free crypto news and intelligence, https://vaultx.llc