New clues emerge in $6.3 billion Binance hack investigation

Blockchain intelligence firm TRM Labs said it attributed the October 29 attack to TraderTraitor with high confidence, citing evidence from blockchain transactions and other intelligence sources.

The group was previously identified by the FBI as responsible for the theft of approximately $1.5 billion from cryptocurrency exchange Bybit in February 2025.

According to TRM Labs, the attackers began preparing at least 36 hours before the Binance theft, conducting test transactions and deploying malicious code before targeting the exchange’s wallets.

Most of the stolen assets were transferred in approximately 20 minutes across 10 blockchain networks, including Ethereum, Bitcoin, Tron, and Solana.

How did the attack unfold?

TRM Labs identified an unusual technique involving Ethereum’s EIP-7702 feature, which allows a cryptocurrency wallet to delegate certain operations to a smart contract.

According to the firm’s analysis, the attacker prepared 50 signed authorizations in advance, allowing a malicious smart contract to take control of a Binance hot wallet, an internet-connected wallet used to process cryptocurrency transactions.

Within minutes, the wallet transferred substantial amounts of cryptocurrency to an attacker-controlled address. Additional funds were withdrawn as new deposits arrived.

TRM Labs said the coordinated transfers across multiple blockchain networks suggested that the attackers may have gained access to Binance’s transaction-signing infrastructure.

Binance has confirmed that its hot wallets were compromised but has not established the full cause of the breach. The exchange said its initial investigation pointed to a potentially compromised laptop, while subsequent findings revealed additional points of intrusion.

Where did the stolen cryptocurrency go?

The investigation also revealed how the attackers attempted to move stolen assets beyond the reach of companies capable of freezing certain cryptocurrencies.

According to TRM Labs, approximately 325 million USDT was exchanged for Ether through decentralized trading platforms, while other stolen assets were used as collateral to borrow additional cryptocurrency.

As of its October 30 analysis, the firm estimated that the attackers controlled more than 420,000 ETH and 18,270 Bitcoin, worth approximately $2.4 billion at the time.

Unlike certain stablecoins,

and Ether cannot be frozen directly by a token issuer, making recovery more complicated once stolen funds have been converted.

A wider pattern of cryptocurrency theft

In a separate report published October 30, TRM Labs estimated that North Korea-linked hackers had stolen approximately $12.8 billion in cryptocurrency across 100 incidents since 2017.

Of that amount, approximately $7.4 billion was attributed to attacks in 2026, with the Binance theft accounting for most of this year’s total.

The firm estimated that North Korean actors were responsible for approximately 85% of the total value stolen in cryptocurrency hacks worldwide so far in 2026.

Despite TRM Labs’ assessment, the attribution of the Binance attack to TraderTraitor has not been independently confirmed by government authorities. Binance has yet to publish its final technical findings.

Earlier, Qazinform reported that Binance had pledged to cover user losses following the estimated $6.3 billion security breach, with approximately $3 billion in affected assets frozen through cooperation with blockchain partners.