Binance Halts Withdrawals Following Historic Six Billion Dollar Cyber Attack

2026-10-30 companies

George Town, Friday, 30 October 2026.
North Korean cyber unit TraderTraitor stole 6.36 billion dollars from Binance on October 29, 2026. While issuers froze 2.7 billion dollars, the attackers retain 2.4 billion dollars in un-freezable assets.

The Attack: Details of the Historic Heist

On the evening of October 29, 2026, at 20:05 UTC, an unprecedented cyber attack unfolded against Binance, the world’s largest cryptocurrency exchange by trading volume [1][2][3][4][5]. Blockchain intelligence firm TRM Labs reported that an attacker initiated a systematic theft of approximately USD 6.36 billion across ten blockchain networks, including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon [1][3][4][5][6]. The operation was executed with remarkable speed, with the majority of funds drained within approximately 20 minutes [1][3][5][6].

The attack vector exploited vulnerabilities in Binance’s hot wallet infrastructure, specifically leveraging Ethereum Improvement Proposal (EIP) 7702. This allowed the attacker to use a pre-signed authorization to convert a Binance hot wallet into a ‘sweeper’ controlled by the operator, enabling the systematic extraction of existing and newly arriving funds [1][3]. The stolen assets included significant quantities of major cryptocurrencies: over 420,000 ETH, 18,270 BTC, and hundreds of millions in various stablecoins [1][2][3][5][6].

Attribution to North Korea’s Elite Cyber Unit

Within hours of the attack, TRM Labs publicly attributed the incident to TraderTraitor, an elite state-sponsored hacking unit linked to North Korea [1][3][4][5][6][7][9]. The attribution was made with “high confidence” based on comprehensive on-chain and off-chain intelligence, including operational similarities to previous attacks such as the USD 1.5 billion Bybit hack in February 2025 and the USD 450 million KelpDAO exploit in April 2026 [1][3][4][5][6][8]. This represents the second major cryptocurrency heist attributed to North Korean actors within two years, underscoring the persistent and sophisticated threat posed by state-sponsored cyber operations to the global financial system [2][3][4][5].

Industry Response: Asset Freezing and Regulatory Implications

In a coordinated industry response, major stablecoin issuers and blockchain platforms moved swiftly to freeze a substantial portion of the stolen assets. Tether, Circle, Ripple, World Liberty Financial, and Arbitrum’s Security Council collectively froze approximately USD 2.7 billion in assets, including USD 1.77 billion in USDT, USD 825 million in USDC, USD 40.5 million in XRP (out of USD 88.5 million frozen), USD 27.8 million in WLF, and 8,426 ETH and 74.6 million ARB [1][2][3][5]. Binance also suspended withdrawals across multiple blockchain networks to contain further losses and assess the full scope of the breach [2][3][4][5].

The attack has intensified regulatory scrutiny over digital asset infrastructure and highlighted systemic vulnerabilities in cryptocurrency custody solutions. Regulators and law enforcement agencies worldwide are now scrutinizing the adequacy of security protocols at major exchanges and the effectiveness of cross-border coordination in tracking and recovering illicitly obtained digital assets [2][3][4][8].

Ongoing Threat and Future Repercussions

As of October 30, 2026, at 00:30 UTC, the attacker retained control of over USD 2.4 billion in un-freezable assets, including approximately 420,000 ETH and 18,270 BTC [1][2][3][5]. To evade detection and dissipation of funds, the attacker utilized decentralized exchanges and lending protocols such as UniswapX and Aave. Notably, the attacker converted about 325 million USDT to ETH at a discount exceeding 10% and borrowed an additional 19,760 ETH by supplying 60 million USDT to Aave [1][3][5].

TRM Labs anticipates that the attacker will attempt to launder the remaining funds through cross-chain bridges, swap services, and over-the-counter (OTC) brokers, posing ongoing challenges for recovery efforts [1][3][6]. The incident has already sent shockwaves through global cryptocurrency markets, with Bitcoin, Ethereum, and Solana experiencing sharp declines of over 4% in the immediate aftermath [2][3][5]. Industry leaders and analysts emphasize the need for enhanced security standards and international collaboration to mitigate future risks and restore confidence in digital asset ecosystems [2][3][4][8].

Sources

Cybersecurity breach Cryptocurrency theft