The Binance North Korea connection came to light because blockchain analysis firm TRM Labs attributed the attack to the TraderTraitor group. The group is described as North Korea's state-sponsored hacker team. Approximately $6.36 billion in digital assets were stolen in the attack. It is also stated that the preparations started at least 36 hours ago.
TRM Labs showed TraderTraitor as responsible for the attack that occurred on October 29, 2026. The company also explained that Binance based its connection to North Korea on blockchain transactions and off-chain intelligence. On the other hand, the incident is similar to the attack in February 2025, when approximately $1.5 billion in assets were stolen from the Bybit exchange. As a matter of fact, the attackers made preparations beforehand in both incidents. He financed the operation wallets with small transfers, and moreover, he put the previously prepared signatures into effect in a short time.
Preparations first started on the morning of October 28. The attackers received small transfers from a cryptocurrency hiding service called Tornado Cash. This method makes it difficult to trace the origin of assets. Additionally, the software was first tested on different wallets. Approximately four hours after the last attempt, the same code was uploaded to one of Binance's hot wallets.
The EIP-7702 mechanism in the Ethereum network particularly stood out in the analysis. This technology allows a standard transaction wallet to run smart contract code with a certain authorization. It is considered that attackers abused this and took control of a hot wallet connected to the internet. Because exchanges keep assets in these wallets for quick withdrawals.
The attackers prepared 50 different pre-signed authorizations on behalf of Binance's Ethereum hot wallet. For example, each wallet has a counter called a nonce that counts transactions. He generated 50 signatures suitable for different counter values, thus aiming for at least one of them to be valid. Once one was accepted, they were able to process their own transactions into the wallet.
Just 3 minutes and 24 seconds after the authorization was activated, 167 thousand 464 ETH in Binance's hot wallet were transferred to the attackers' addresses. Additionally, 63 different tokens, including 1.615 billion USDT, were also offloaded. Moreover, since the authorization was not revoked, subsequent assets were withdrawn again and again.
However, the attack was not limited to Ethereum. Unauthorized transfers were also made on the Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon networks. The attackers transferred billions of dollars of assets from wallets on 10 blockchains to their own addresses in approximately 20 minutes. Some wallets were even almost completely empty.
The key and signing methods of these wallets are different. Still, valid transactions were sent to the attackers' addresses during the same time period. TRM Labs considers this a significant finding. According to the company, this indicates that attackers may have also compromised the infrastructure that generates transaction confirmation on different networks. However, Binance has not yet disclosed the exact source and full technical details.
According to TRM Labs' analysis of Binance North Korea, attackers tried to convert assets at risk of freezing into other digital assets. For example, approximately 60 million USDT was deposited as collateral on the decentralized lending platform Aave. Approximately 19 thousand 760 ETH was borrowed in return. This provided access to an asset that is more difficult to freeze. Aave froze the affected markets.
Upon initial investigation, Binance thought that the incident might be linked to the seizure of an engineer's computer. However, subsequent investigations revealed other points of the violation. The company stated that the attack was complex and that the investigation was ongoing in coordination with law enforcement. He also said that the details were not yet clear and that he would share confirmed information.
The company reiterated that user assets are safe. Losses will be covered by the user protection fund called SAFU and the company's own resources. Moreover, deposit transactions were not affected by the attack. When withdrawals stopped, asset outflows also ended. We are working with business partners to freeze assets worth approximately $3 billion. Binance plans to restart withdrawal services within 45 hours from the time of the announcement.
