An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains on 29 October, most of it in about 20 minutes from 20:05 UTC, according to blockchain analytics firm TRM Labs. TRM calls it “the largest crypto theft on record”, about four times the $1.5 billion Bybit hack of February 2025.
Stablecoin issuers and Arbitrum’s Security Council have frozen roughly $2.7 billion, TRM says. By our arithmetic, that is about 42% of the total taken. Binance co-CEO Yi He wrote on X: “Binance will cover all hacking losses.”
Short explainer · Binance hack
A vertical news Short narrated from this piece’s headline and opening line.
Business Pill · Least Privilege
An evergreen Business Engineer explainer on least-privilege access. It explains the general idea only and does not discuss Binance.
The key insight: TRM Labs traced about $6.36 billion out of Binance wallets on ten chains, most of it within about 20 minutes, and counts roughly $2.7 billion frozen; by our arithmetic, the about $2.4 billion TRM says the attacker still controls is itself about 1.6 times the Bybit theft.
Update (30 Oct): Published estimates of the loss still differ.Seoul Economic Daily, citing The Wall Street Journal, reported that hackers stole at least $1.7 billion. Taylor Monahan of SEAL 911 told the Journal the hackers took more than $2 billion and as much as $5.5 billion, and Glassnode estimated about $5.3 billion was withdrawn, Seoul Economic Daily reported. TRM Labs puts the total at about $6.36 billion, and Binance said about $6.3 billion of assets was impacted. Binance said about $3 billion has been frozen so far, Seoul Economic Daily reported; TRM counts roughly $2.7 billion frozen.
What happened next (30 Oct): CZ points to Binance’s SpaceX shares. Binance founder Changpeng Zhao wrote on X at 09:19 UTC, replying to Elon Musk: “Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion.” Binance co-founder Yi He replied that the company’s revenue for the year “is sufficient to cover the losses, so we do not yet need to sell the SpaceX shares”. Zhao then said he had not said anything about selling SPCX shares and was only showing funds. PANews, citing a Zhao post, reported losses of about $6 billion-plus, about $3 billion frozen and about $1 billion-plus from the SAFU fund, leaving a gap of about $2 billion that Zhao called “still painful, but manageable”. A Kalshi post framed the remarks as Binance possibly using the stake to cover losses; Zhao’s own posts do not say that. By our arithmetic, $1 billion is about 42% of the roughly $2.4 billion TRM says is beyond reach, and half of the roughly $2 billion gap PANews reported; Zhao says the stake is worth more than that, which is more than twice the $500 million invested.
Binance said a “security incident” on its platform impacted about $6.3 billion of assets and that about half had been frozen with help from other platforms, the BBC reported. Early checks show the suspected hack may have involved an engineer’s laptop that had been compromised, Binance said, per the BBC.
Yi He wrote on X that deposits and withdrawals were “temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement” and that Binance would share a full post-mortem. Former CEO Changpeng Zhao, who no longer manages the exchange, wrote: “It does look like a hack on Binance.” Binance.US said it was not affected, according to The Block.
Crypto taken from Binance on 29 October, about $6.36 billion as traced by TRM Labs: about $2.7 billion frozen, about $2.4 billion beyond reach, and the rest (our arithmetic: $6.36B minus the two totals), next to the $1.5 billion Bybit theft of February 2025. Source: TRM Labs, figures as of 00:30 UTC on 30 October.
What Was Posted on X
User funds are safe.
Binance will cover all hacking losses.
Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.
We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates.
Binance co-CEO Yi He wrote that user funds are safe, that Binance will cover all hacking losses, and that deposits and withdrawals were temporarily suspended while the team conducts security checks and works with law enforcement.
North Korean hackers stole approximately $6.36 billion from Binance in what blockchain intelligence firm TRM Labs described as the largest cryptocurrency theft on record, attributing the attack to the state-sponsored group TraderTraitor.
The funds moved across 10 blockchains beginning at 20:05 UTC on October 29, with most transfers occurring within 20 minutes.
TRM Labs said the attack bore similarities to previous North Korean-linked operations, including the February 2025 Bybit hack.
Tether, Circle, Ripple, World Liberty Financial and Arbitrumโs Security Council have frozen approximately $2.7 billion in assets, while an estimated $2.4 billion remains beyond their reach.
The account @osint613 summarised TRM Labs’ findings: about $6.36 billion taken across 10 blockchains, attributed by TRM to North Korea’s TraderTraitor, with about $2.7 billion frozen and an estimated $2.4 billion beyond reach.
@cryptoblaney Super intelligence agents will at some point do this to gain currency for themselves, not a human
Elon Musk, replying on X to @cryptoblaney on 30 October, wrote: “Super intelligence agents will at some point do this to gain currency for themselves, not a human.” The post is his comment; it does not say AI was involved in this hack.
@elonmusk @HuaweiMate6 Elon, have a lot of respect for you, but bad time to troll. Please stop.
Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion.
Would appreciate if you show a little support. Thanks!
Changpeng Zhao, replying to Elon Musk on X on 30 October, wrote that Binance’s SPCX shares, from its $500 million investment in Musk’s Twitter takeover, are worth more than a billion, and asked Musk to show a little support.
In fact, it was North Korea that hacked Binance and stole crypto worth $6.36b, which makes it the largest hack in history. And it was finished in just 20 minutes.
Chubby (@kimmonismus) says North Korea was behind the Binance hack, putting the haul at $6.36 billion and calling it the largest hack in history, finished in just 20 minutes; those are the poster’s claims.
Where the $6.36 Billion Went
TRM says it valued each transfer at the asset’s price when it was taken. Ethereum accounts for about $3.79 billion, including 1.875 billion USDT and 823 million USDC. Bitcoin outflows total 18,270 BTC, about $1.47 billion. Tron accounts for about $628 million and the XRP Ledger for about $296 million.
At current prices, the same assets are worth about $6.23 billion, TRM says. Its figures reflect what it saw onchain as of 00:30 UTC on 30 October.
Who Froze What
Tether froze about 1.77 billion USDT, TRM says. Its first freeze of 971.1 million USDT came at 21:01 UTC, 37 minutes after the main sweep. Circle froze about 825 million USDC, Ripple froze 40.5 million RLUSD and World Liberty Financial froze 27.8 million USD1. Arbitrum’s Security Council moved about $30 million in ETH and ARB out of the attacker’s reach.
Binance said at 23:35 UTC that the verified total frozen had reached $2.54 billion, according to TRM. TRM says the attacker still controls more than 420,000 ETH and 18,270 BTC, about $2.4 billion. By our arithmetic, that unfrozen part alone is about 1.6 times the Bybit theft.
Racing the Freezes
TRM says the attacker sold about 325 million USDT to market makers for about 122,300 ETH. That implies a price near $2,650 per ETH when ETH traded around $2,300 to $2,350, which TRM calls a discount of more than 10%. A second wallet borrowed about 19,760 ETH against USDT on Aave, after which Aave froze the affected markets, TRM says.
How TRM Says the Attacker Got In
On Ethereum, the attacker used an EIP-7702 delegation with 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper it controlled, according to TRM. In the same window, Binance wallets on nine other chains sent funds through ordinary signed transfers.
In TRM’s assessment, this “points to a compromise of Binance’s hot wallet signing infrastructure”. TRM attributes the attack to TraderTraitor, which it describes as North Korea’s elite hacking unit, and says: “We make this judgment with high confidence.” TRM notes the FBI named the same group as responsible for the Bybit hack.
Why It Matters for Exchanges
Our Binance business model breakdown explains how the exchange makes money. The BBC reports the company said in 2024 that it had more than $160 billion in assets under custody. Coinbase said it was unaffected, according to the BBC; our Coinbase earnings piece covers its latest quarter. Our USDC piece explains how issuers such as Circle sit inside crypto’s payment rails.
The Structural Read
As we read TRM’s timeline, the first freezes came from stablecoin issuers: Tether froze 971.1 million USDT at 21:01 UTC, 37 minutes after the main sweep, and Circle froze 823 million USDC three minutes later.
TRM says the attacker converted freezable stablecoins into assets beyond any issuer’s reach, swapping about 325 million USDT for ETH at what TRM calls a discount of more than 10%, and that it still controls 18,270 BTC.
TRM says its method evidence points to Binance’s hot wallet signing infrastructure, while Binance said early checks pointed to an engineer’s compromised laptop, per the BBC; the two accounts are not yet reconciled in a published post-mortem.
TRM Labs, 30 October 2026
“the largest crypto theft on record”
Three Implications
FOR BINANCE USERS Yi He wrote that Binance will cover all hacking losses and that deposits and withdrawals were temporarily suspended; Binance has said a full post-mortem will follow.
FOR STABLECOIN ISSUERS TRM says Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, most of the roughly $2.7 billion frozen.
FOR EXCHANGES AND COMPLIANCE TEAMS TRM says funds from the Bitcoin peel chain and the ETH consolidation wallets are likely to reach exchanges, swap services and OTC desks, and urges screening against the addresses it has labelled.
What Is Not Established
Binance has not named the attacker; the North Korea attribution is TRM’s. The laptop explanation comes from Binance’s early checks as reported by the BBC, and Binance has said a full post-mortem will follow. TRM’s totals were a snapshot at 00:30 UTC and may change as freezes continue. The 42% and 1.6-times figures are our arithmetic from TRM’s numbers.
This Week In The AI Supercycle
Execution Fault Lines, Concentrated Demand, and Geopolitical Firewalls
This week’s issue: the AI build is not short of demand for its parts. It is short of cheap money, and its end revenue rests on a narrow base of large, often venture-funded buyers.
TRM Labs traced about $6.36 billion out of Binance on 29 October, about four times the Bybit theft, and counts roughly $2.7 billion frozen, about 42% by our arithmetic. Binance says it will cover all losses.
A note on sourcing. The amounts, freezes, method and North Korea attribution come from TRM Labs’ post of 30 October, a snapshot as of 00:30 UTC. Binance’s statements are as reported by the BBC and The Block, and from Yi He’s and Changpeng Zhao’s posts on X. The 42% and 1.6-times figures are our arithmetic.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
