The Binance hack has been linked to North Korea’s Lazarus Group by blockchain investigators, who suspect the state-backed hackers stole approximately $6.3 billion from the cryptocurrency exchange on October 29.
Summary
- TRM Labs has linked the $6.3 billion Binance hack to North Korea’s TraderTraitor hacking unit with high confidence.
- Blockaid CEO Ido Ben-Natan said attackers moved at least $3.5 billion across four blockchains in under an hour.
- Investigators traced the theft to compromised transaction-signing controls, including 50 Ethereum authorizations targeting one hot wallet.
- Binance reported approximately $3 billion in frozen assets and pledged to cover customer losses.
- Withdrawals remain suspended during security upgrades, with Binance expecting services to resume within 48 hours.
According to TRM Labs, its investigators have attributed the attack to TraderTraitor, a North Korean hacking unit associated with Lazarus, with high confidence. Blockchain investigator ZachXBT separately identified Lazarus as the likely attacker, although Binance has not confirmed who carried out the theft.
In comments to crypto.news, Ido Ben-Natan, co-founder and CEO of blockchain security firm Blockaid, said the attack surpassed previous cryptocurrency thefts in scale.
“This is the biggest crypto hack in history. Our analysis shows at least $3.5 billion moved out of Binance hot wallets on Ethereum, Arbitrum, Optimism and Avalanche in under an hour, more than double the Bybit theft in February 2025,” Ben-Natan said.
He noted that investigators had identified additional transfers involving Bitcoin and Tron, while his team continued tracing the stolen assets.
Meanwhile, blockchain tracking platform Onchain Lens reported that the Binance attacker had transferred 17,260 ETH, worth roughly $38.82 million, to a new wallet amid concerns that the funds could be laundered through Tornado Cash or other cryptocurrency mixers.
As per the tracker, the attacker still controlled almost 480,720 ETH, valued at $1.08 billion, which cannot be frozen by a token issuer. The receiving wallet was identified as 0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea.
Lazarus Group suspected as Binance hack reaches ten blockchains
TRM’s investigation traced about $6.36 billion leaving Binance-controlled wallets across ten blockchain networks, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger.
Most of the stolen funds were moved in a span of about 20 minutes, beginning at 20:05 UTC. Around $3.79 billion was transferred on Ethereum, while Bitcoin and Tron accounted for another $1.47 billion and $628 million, respectively.
Investigators identified 233.46 million XRP, worth nearly $296 million, leaving five Binance wallets before the Ethereum attack began.
The security firm said preparations started at least 36 hours before the theft. An attacker-controlled wallet received three small Tornado Cash withdrawals and tested malicious code before targeting Binance.
TRM linked the activity to TraderTraitor using blockchain transactions and other intelligence, although it did not publicly disclose all the evidence behind its attribution.
The FBI has previously identified that TraderTraitor was responsible for the February 2025 Bybit theft where approximately $1.5 billion was drained from the exchange. U.S. authorities have accused North Korean hacking operations of stealing cryptocurrency to help finance the country’s weapons programs.
Blockaid explains how attackers accessed Binance wallets
Blockaid’s technical investigation identified an unusual Ethereum transaction containing 50 EIP-7702 authorizations targeting Binance 14, one of the exchange’s busiest hot wallets.
EIP-7702 allows an Ethereum wallet to authorize smart contract code to operate on its behalf. The attacker prepared authorizations using 50 consecutive transaction counters, increasing the chance that one would match the wallet’s current counter.
Only one authorization succeeded, allowing a malicious contract to transfer assets from the wallet.
“The attacker effectively reprogrammed a major Binance Ethereum hot wallet so that a single operator could drain it, including any new money deposited into it,” Ben-Natan explained to crypto.news.
The attacker transferred approximately $2.5 billion from Binance 14, including 167,464 ETH and more than 1.6 billion USDT. Subsequent transfers targeted newly received funds.
Investigators found other Binance wallets moving assets through ordinary signed transactions across several networks. TRM believes the attacker may have gained access to the exchange’s transaction-signing infrastructure.
Binance identifies possible laptop compromise as $3 billion frozen
In its security update, Binance said its initial investigation pointed to a compromised DevOps engineer’s laptop that may have allowed unauthorized access to an internal service container.
The exchange found no evidence of leaked private keys and said it would publish a detailed investigation once the cause was established.
Tether CEO Paolo Ardoino confirmed freezing more than 1.567 billion USDT, while Circle CEO Jeremy Allaire reported freezing over 800 million USDC. The Arbitrum Security Council secured approximately 74.6 million ARB and 8,425 ETH linked to the attacker.
Binance withdrawals remain paused
Binance has pledged to cover losses using its SAFU fund and company resources while working with law enforcement and blockchain investigators.
At the same time, the exchange said deposits remained operational, but withdrawals would stay paused while it upgraded withdrawal systems and address controls.
Binance expects withdrawals to resume within 48 hours and said a full report on the attack’s cause will follow.
Cryptocurrency markets also came under selling pressure following the hack, with Bitcoin briefly falling below $77,000. Total liquidations across the derivatives market exceeded $1.5 billion over 24 hours.
