The cryptocurrency exchange Binance reopened withdrawals in stages after an attack that moved approximately USD 6.36 billion from its wallets on ten blockchains. The breach began on October 29, 2026 when attacker-controlled addresses extracted funds across networks including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. The Federal Bureau of Investigation (FBI) publicly identified a Pyongyang-linked hacking unit known as TraderTraitor as responsible, confirming earlier chain-analysis attributions and noting sophisticated laundering techniques observed onchain.
Scale and mechanics of the October 29, 2026 theft
The operation unfolded rapidly: in roughly 20 minutes starting at 20:05 UTC an attacker moved the bulk of the stolen value, with further transfers continuing in a second wave later the same night. Blockchain tracing firms reconstructed the flows and valued transfers at the spot price at the time to reach an estimate of about USD 6.36 billion. The composition of the haul was concentrated in Ethereum (including large amounts of ERC-20 tokens and stablecoins) and Bitcoin, with major outflows on Tron and substantial sums in XRP and SOL. Analysis points to premeditated staging: small Tornado Cash withdrawals, rehearsals on non-critical wallets, then the rapid execution on exchange hot wallets.
How access was gained and onchain techniques used
Investigators and analysts concluded the attacker compromised a live signing environment for exchange hot wallets. On the Ethereum side the thief exploited a delegation mechanism introduced by the EIP-7702 change, which allows a wallet to delegate behavioral control to a contract after signing an authorization; a single transaction delivered multiple pre-signed delegations that redirected a Binance hot wallet to a sweeper contract controlled by the operator. For other chains the attacker executed ordinary signed transfers, consistent with a breach of the hot wallet signing infrastructure. Laundering tactics included rapid swaps, use of market-making counterparties, and borrowing against stablecoins to outrun freezes.
Freezes, issuer interventions and Binance response
Following the theft, stablecoin issuers including Tether, Circle and Ripple-linked services froze more than USD 2.67 billion of tokens that the attacker attempted to move, while Arbitrum’s security body froze significant ETH and ARB balances on its chain. Binance suspended withdrawals as a precaution and later announced a phased reopening, restoring withdrawals for assets such as Bitcoin, Ethereum, BNB, XRP, Base, DOGE and Optimism as security checks completed. Binance also pledged to cover the majority of the loss by deploying roughly USD 6 billion from its treasury, insurance and reserve pools to replenish user balances.
Market effects and customer behaviour after reopening
When withdrawals resumed the exchange saw notable customer activity: net outflows in the days after reopening reached approximately USD 4.72 billion, an amount equal to a modest percentage of on-platform assets but large in absolute terms. Trading volumes across crypto markets rose amid volatility, with spot and derivatives positions liquidated and price swings for major tokens. Observers noted that while retail users made withdrawals, some traders kept funds on exchange for liquidity and access, and institutional participants were reported to have grown more cautious about counterparty risk following the incident.
Attribution and ongoing tracing efforts
The FBI and private blockchain analytics firms linked the incident to TraderTraitor, the same group implicated in a prior high-value theft from another exchange. Attribution rests on a combination of onchain signatures, behavioral parallels with earlier incidents, and offchain intelligence. Firms tracking the flows continue to alert partners through monitoring networks, and investigators are focused on mapping conversion chains as the attacker swaps assets, uses lending protocols, or works with intermediaries. Large portions of the stolen funds remain traceable, though converting them into fiat or dispersing them through decentralized routes complicates rapid recovery.
The sequence of events illustrates how a single compromise of hot wallet signing processes can cascade into cross-chain losses at unprecedented scale. Exchanges, issuers and blockchain security teams have expanded coordination since the incident, and the industry response so far has blended technical containment, legal reporting and financial remediation to stabilize user access and limit further asset flight.
