News Desk · Crypto crime

Binance says about $6.3 billion stolen from its hot wallets; TRM links the attack to North Korea

The exchange paused withdrawals, says user funds are safe and that it will cover losses, while stablecoin issuers froze billions and blockchain analysts traced the funds across 10 networks.

Developing storyCrypto crimeGlobal29 Oct 20263 min readUpdated 30 Oct 2026

Binance, the world's largest crypto exchange by assets, said about $6.3 billion was stolen in a security incident on 29 October 2026. Blockchain intelligence firm TRM Labs put the figure at about $6.36 billion, valued at the price of each asset when it was taken, including about $3.79 billion on Ethereum and 18,270 bitcoin (about $1.47 billion).

Binance said it had temporarily suspended withdrawals on multiple networks as a precaution, that user funds are safe and that it will cover all losses. It said it is working with law enforcement partners to identify those responsible and will publish a detailed technical post-mortem once its investigation is complete. Al Jazeera reported that Binance's initial investigation suggested a hacker made unauthorised transactions after gaining access to an engineer's compromised laptop.

According to TRM's on-chain analysis, preparation began at least 36 hours earlier, funded by small withdrawals from the Tornado Cash mixer. On Ethereum, the attacker used an EIP-7702 delegation to point a Binance hot wallet at a sweeper contract it controlled. On nine other networks, Binance wallets sent funds through ordinary signed transfers, which TRM assesses as a compromise of the exchange's hot wallet signing infrastructure. Funds moved across Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.

Stablecoin issuers moved quickly. TRM reported that Tether froze about 1.77 billion USDT across attacker wallets and Circle froze 823 million USDC in coordination with law enforcement. Ripple and World Liberty Financial froze their own tokens, and the Arbitrum Security Council forced transfers out of an attacker wallet. Binance said verified frozen funds reached about $2.54 billion late on 29 October and later put the figure at about $3 billion.

TRM assessed with high confidence that the attack was carried out by TraderTraitor, a North Korean state hacking unit linked to the Lazarus Group, which the FBI named as responsible for the $1.5 billion Bybit hack in February 2025. No government agency had publicly attributed the Binance attack at the time of writing. TRM observed the stolen funds being swapped through decentralised exchanges, used as collateral to borrow on lending protocols, and the bitcoin being split into smaller amounts.

This account is based on the company's own public statements and on-chain analysis by a blockchain intelligence firm, as reported by the sources below. No regulator or government agency had published a statement when it was written. Figures may change as investigations continue.

Why it matters to AML professionals

Proceeds from large exchange hacks move fast and in pieces. Within hours, stolen funds here were swapped at a discount, borrowed against on lending protocols and split into smaller bitcoin amounts. Exchanges, banks and payment firms may see these funds arrive later through OTC brokers, crypto ATMs, nested accounts or fiat off-ramps. If TRM's attribution is confirmed, any dealing with these funds also raises North Korea sanctions exposure, which turns a fraud case into a sanctions and proliferation financing case.

Red flags in this case

Deposits from wallets that blockchain analytics tools link, directly or within a few hops, to the attacker addresses published by investigators.
Large volumes of stablecoins swapped for ETH or bitcoin at a steep discount to market price, suggesting a seller who needs to move funds quickly.
Crypto supplied as collateral and immediately borrowed against, with the borrowed assets moved on rather than used.
Bitcoin arriving in round chunks (for example 100 or 1,000 BTC) through a chain of new wallets, a pattern known as a peel chain.
New or dormant customers suddenly offering large crypto-to-fiat trades through OTC desks shortly after the hack.

If this landed in your queue

Screen the customer's deposit addresses and counterparties against the attacker wallets flagged by blockchain analytics providers and any law enforcement lists, and keep screening as new addresses are published.
Trace the funds back through intermediate wallets rather than stopping at the first hop, and document each hop in the case file.
Check whether the customer can explain the source of the crypto with records such as exchange statements or transaction history from before 29 October 2026.
Escalate under your sanctions procedures if funds trace to the attack, given TRM's North Korea attribution, and freeze or hold where your policies and local law require.
File a SAR (or local equivalent) where suspicion remains, naming the wallet addresses, chains, amounts and dates in the narrative.

Key terms

Hot wallet: A crypto wallet kept online so an exchange can process withdrawals quickly. It is more convenient than offline (cold) storage but easier to attack.
EIP-7702 delegation: An Ethereum feature that lets a normal wallet temporarily run code from a smart contract. Here, attackers used it to point a Binance wallet at a contract that swept its funds.
Peel chain: A laundering technique where a large crypto balance is split off in smaller pieces through a long series of new wallets to make tracing harder.
Lazarus Group: The name commonly used for North Korean state hacking groups behind many of the largest crypto thefts.

Interview angle

A customer deposits $400,000 in USDC that blockchain analytics shows came from a wallet three hops away from a major exchange hack. What do you do?

Explain that three hops is still close exposure. Hold the funds under policy, trace and document the path, ask the customer for the source of the crypto, check for sanctions exposure if the hack is attributed to a sanctioned country, escalate to the sanctions or financial crime team and file a SAR if suspicion remains.

Sources

Go deeper on AMLift

Get the next story in your feedFollow AMLift on LinkedIn for new enforcement breakdowns, the weekly AML challenge and new tools.

Follow on LinkedIn

Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.