TRM ties $6.36 billion Binance theft to TraderTraitor
Original title: Binance Hit by Biggest Crypto Heist in History – North Korean TraderTraitor Group Reportedly Stolen $6.36 Billion
Sweeper contracts and EIP-7702 delegations drained hot wallets; about $2.7 billion was later frozen.
TRM Labs says an attacker drained about $6.36 billion from Binance wallets across ten blockchains on October 29, 2026, mostly within about 20 minutes. It attributes the theft to North Korean-linked TraderTraitor with high confidence and says preparation began at least 36 hours earlier. Ethereum activity used EIP-7702 delegations and a sweeper contract; other chains used ordinary signed transfers. TRM suspects compromised signing infrastructure. Binance had not published a root cause, and this report does not establish the initial entry point.
Unconfirmed: Attribution is TRM’s high-confidence assessment; Binance’s root cause and the initial access method are not established here.
- Ethereum was about $3.79 billion, Bitcoin $1.47 billion, and Tron $628 million.
- One sweep moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
- A Bitcoin wallet sent 18,270 BTC, then split it through a peel chain.
- Attackers converted about 325 million USDT into roughly 122,300 ETH.
- Figures cover blockchain observations through October 30 at 00:30 UTC.
Impact: About $6.36 billion in cryptocurrency stolen from exchange wallets
- 1.Screen deposits and counterparties and alert on unexpected wallet delegations.
- 2.Reject unapproved EIP-7702 authorizations and separate signing systems by chain and wallet tier.
- 3.Test revocation procedures so a malicious delegation cannot keep redirecting deposits.
- Vendors
- Binance
- Threat actors
- TraderTraitor
- Victims
- Binance
- Organizations
- TRM LabsTetherCircleRippleWorld Liberty Financial
- Countries
- North Korea
From the original article
4 min read at cybersecuritynews.com
Binance reportedly lost approximately $6. 36 billion in cryptocurrency on October 29, 2026, after an attacker drained wallets across ten blockchains. TRM Labs describes the incident as the largest cryptocurrency theft ever recorded, with the majority of the stolen funds transferred out within approximately 20 minutes of the attack.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.