Binance Hack Blamed on North Korea by FBI in $6B Theft

Estimated reading time: 10 minutes

Key Takeaways

• FBI attribution: On October 31, 2026, the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29. It called the activity TraderTraitor. BBC reported on November 3 that North Korea denied involvement.
• Scale and speed: TRM Labs, a blockchain analytics company, says about $6.36 billion left Binance wallets across 10 blockchains, most of it in about 20 minutes.
• The Ethereum trick: TRM says the attacker prepared 50 pre-signed EIP-7702 authorizations in advance. Blockaid's technical reconstruction says one of them matched the wallet's counter (its nonce) and let the attacker sweep a hot wallet in one burst.
• A shifting explanation: Binance first blamed a compromised DevOps engineer's laptop. Co-CEO Richard Teng then said the attack was more complex, and on November 3 Binance said a fake job interview led to malware, according to BleepingComputer. A full postmortem was promised.
• Money status: About $3 billion was reported frozen by third parties, per Binance's estimate. Frozen is not the same as returned. Binance says it will cover all losses with its SAFU fund and company money, which is a pledge, not a completed payout.

The Binance hack started with careful preparation. TRM Labs says the attackers prepared 50 EIP-7702 authorizations ahead of time. Blockaid's reconstruction says one of them matched the wallet's nonce, and the attacker used that match to drain a Binance hot wallet in a single burst.

The FBI now says North Korea was behind the theft. TRM puts the total at about $6.36 billion, and Binance's own estimate was about $6.3 billion. North Korea has denied it.

This matters well beyond crypto. The story shows how wallet-signing systems, employee laptops and transaction controls can each become a single point of failure. After a breach, regulators, customers and reimbursement duties arrive fast. Any founder who holds money, keys or customer data should read the details.

How the Binance Hack Moved $6.36 Billion Across 10 Blockchains in About 20 Minutes

The main theft took place on October 29, 2026. TRM Labs published its analysis on October 30, and the FBI published its alert on October 31.

The sources use different totals. They are not all measuring the same thing:

• About $6.36 billion: TRM's figure for what an attacker moved out of Binance wallets on ten blockchains. This is a company analysis.
• About $6.3 billion: Binance's estimate of total impact, as reported in an October 30 article by Kyle Torpey.
• More than $6 billion: The wording used by the FBI and by NPR.
• About $3 billion frozen: Binance's estimate, in the same October 30 article, of funds frozen by various third parties.

Most of the money left Binance-controlled wallets in roughly 20 minutes, per TRM. A freeze can limit the final loss, but it does not return the money on its own.

The groundwork came first

TRM says the attacker funded an operator wallet with small withdrawals from Tornado Cash. That is a crypto mixer, a service that blends coins from many users to hide where they came from. TRM also says the attacker prepared the attack well in advance.

Other reports say the groundwork began at least 36 hours before the theft. The sources linked here do not confirm that exact figure, so treat it as reported but not verified.

An earlier attempt may have helped

NPR reported that a prior attempted compromise let hackers learn more about Binance and its systems before the later theft. The summary available for this story does not say when that earlier attempt happened. It is also based on Binance's account, so treat it as company-reported.

What happens to the stolen money

The FBI said the stolen assets were converted primarily into Ethereum. It said they are expected to be laundered through DeFi (decentralized finance apps) and instant swap services. That is a forecast, not a finished event.

Source: TRM Labs analysis of the Binance theft, published October 30, 2026; FBI alert on North Korea and the Binance attack, October 31, 2026; NPR report, November 3, 2026; Gizmodo report on Binance investigating the hack

The EIP-7702 Exploit Explained: 50 Signed Authorizations and One Matching Nonce

The Ethereum part of the story is the most technical, but the idea is simple. The attacker used a newer Ethereum feature to turn a normal Binance wallet into a wallet that ran the attacker's code.

What EIP-7702 does

EIP-7702 went live in the Pectra upgrade in May 2025. It lets an ordinary Ethereum wallet temporarily run code from a smart contract, which is a small program stored on the blockchain.

An ordinary wallet, called an externally owned account (EOA), is controlled by a private key. On its own it cannot enforce rules or batch several actions together. EIP-7702 lets it sign an authorization that hands its behavior to a smart contract. That makes useful things possible, such as combining a token approval and a transfer in one step.

How the attacker used it

According to the October 30 article describing Blockaid's reconstruction, the attacker turned Binance 14, one of Binance's Ethereum hot wallets, into a wallet running an attacker-controlled "sweeper" contract. A hot wallet is one kept online for everyday withdrawals. A sweeper contract moves everything out in one go.

The key detail is the nonce, a counter that goes up every time an Ethereum account sends a transaction. Binance 14 was busy processing withdrawals, so its nonce kept changing. The attacker could not know which nonce would be current when the authorization landed.

So the attacker submitted a transaction with 50 EIP-7702 authorizations. Each was signed by Binance 14 and tied to a different consecutive nonce. One of them matched.

That authorization pointed Binance 14 to a sweeper contract that only the attacker's wallet could operate. Minutes later, the attacker used it to move approximately:

• 167,464 ETH
• $1.6 billion in USDT
• More than 60 other tokens

The article puts the single transaction at roughly $2.5 billion.

What EIP-7702 did not do

The same article stresses that EIP-7702 did not let a stranger take over any wallet. The authorization still had to be signed by the wallet's key, or by infrastructure able to produce a valid signature. The EIP-7702 details also do not apply to the other blockchains involved.

BleepingComputer reports that Binance said the attackers abused the EIP-7702 mechanism after withdrawals were suspended. The sources reviewed do not explain the exact sequence, so we cannot say more about it. Binance's account is also unconfirmed by outside parties.

Source: TRM Labs analysis of the Binance theft; Blockaid technical reconstruction of the theft; BleepingComputer report on Binance's fake job interview statement, November 3, 2026

North Korea TraderTraitor: What the FBI, TRM Labs and Analysts Say

The FBI said on October 31, 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29. It identified the activity as TraderTraitor. This is the strongest attribution so far, because it comes from a government agency.

TraderTraitor is described as a North Korean state-sponsored hacking group. It is also associated with the broader Lazarus Group.

Analysts reached the same conclusion

Several outside voices point the same way:

• TRM Labs said it attributed the theft to TraderTraitor with "high confidence." It cited features that resemble earlier North Korea-linked heists, including the $1.4 billion Bybit hack in February 2025.
• Jonathan Levin, co-founder and CEO of Chainalysis, wrote on X that the hack was "likely done by DPRK group TraderTraitor," citing links to previous hacks.
• The Wall Street Journal reported that investigators were pointing to North Korea. It quoted Elliptic founder Tom Robinson: "This is state-sponsored theft at a scale that no criminal group comes close to, with the proceeds funding North Korea's weapons programmes."

North Korea says it was not involved

BBC News reported on November 3 that North Korea denied being behind the hack. BBC also said blockchain analysts and the FBI described the attack as led by the state-backed group TraderTraitor.

How strong is the "consensus"?

Investigators broadly agree on North Korea, and the main open question is how the breach worked. But look at who is speaking. The voices are a government agency, blockchain analytics companies and an executive posting on X. Those companies sell investigation services, so their statements are not neutral, independent review.

The materials used for this story include no independent academic or peer-reviewed analysis of the attribution. Read the agreement as strong but not independently verified.

Source: FBI alert on North Korea and the Binance attack, October 31, 2026; TRM Labs analysis of the Binance theft; BBC News report, November 3, 2026; Jonathan Levin's post on X; Wall Street Journal report on investigators pointing to North Korea; Gizmodo report on the $1.4 billion Bybit hack

The Binance Postmortem Is Still Pending, and the Explanation Keeps Growing

Binance's account of the breach has grown in stages. Keep each statement separate, because they describe different levels of detail.

Stage one: the DevOps laptop

Binance's first public explanation pointed to a laptop belonging to a DevOps engineer. DevOps staff run the systems that keep software and servers working.

Binance said its preliminary investigation suggested the compromised laptop let an attacker reach a service container and submit unauthorized withdrawal transactions. A service container is an isolated environment that runs part of a company's software. Binance added that it found no evidence private keys had been leaked.

Stage two: "a more complex attack process"

Co-CEO Richard Teng then posted on X: "The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process."

Teng said Binance had found additional points of breach. He did not attribute responsibility to any specific individual.

Stage three: the fake job interview

On November 3, BleepingComputer reported that Binance said North Korean hackers used a fake job interview to trick an employee into installing malware. According to Binance, the malware helped compromise wallet infrastructure. This is Binance's own account.

The sources reviewed do not say whether this employee is the same DevOps engineer from the first statement, so we won't link the two.

What the postmortem needs to answer

Binance promised a detailed technical postmortem once its investigation is complete. We found no published full postmortem in the materials reviewed.

As of the October 30 report, how the attacker gained enough authority to produce valid signatures across multiple blockchains was still unclear. The postmortem will need to explain:

• The compromised laptop and the additional breach points
• How the attacker obtained signing authority
• Which controls failed to stop withdrawals worth billions of dollars

Source: Binance Square preliminary statement; Richard Teng's post on X; BleepingComputer report on Binance's fake job interview statement, November 3, 2026; NPR report, November 3, 2026

Frozen Funds, the SAFU Pledge and Why Binance Says This Is Not FTX

The theft has drawn comparisons to the FTX collapse. Based on what was known in the October 30 report, the situations look quite different.

What Binance has promised

Binance says customer funds are safe. It says it will cover all losses through SAFU, the Secure Asset Fund for Users, and other company funds. That is a promise, and the sources reviewed do not confirm that any reimbursement has been completed.

The same report says there is no public evidence this was an inside job, or that Binance is insolvent. Those points describe what was known at the time, not a final finding.

Why frozen funds change the math

Binance estimates that about $3 billion was frozen by various third parties. The Oct 30 report reasons that the true loss is therefore likely lower than the headline number. It compared that possible loss to the $4.3 billion in penalties Binance agreed to pay in its 2023 settlement with the U.S. Department of Justice over anti-money-laundering and sanctions violations.

That comparison is the author's reasoning, not a reported outcome. We do not know how much frozen money will be returned.

The CZ and Musk exchange

Binance co-founder and former CEO Changpeng "CZ" Zhao pushed back on X after Elon Musk reacted to a post comparing Binance with FTX. Zhao asked Musk to stop trolling and pointed to Binance's investment in SpaceX as evidence of the company's resources. That is Zhao's claim, and we have not verified it.

Source: Gizmodo report on the 2023 Binance DOJ settlement; Changpeng Zhao's post on X

What This Means for Startups and Small Businesses

You probably do not run an exchange. But the pattern here applies to any company that holds money, keys or customer data. These steps are our practical suggestions, not findings from the Binance investigation.

Treat signing power like a vault

• Limit what one system can sign. If a single wallet, service or account can move huge sums, it is a single point of failure.
• Separate keys from everyday systems. Signing infrastructure should not sit within easy reach of general-purpose servers or laptops.
• Review new account features before you use them. Features like EIP-7702 add power, and every added power needs rules around who can authorize it.

Protect the people who hold access

• Harden engineer laptops. Binance's first explanation was a single compromised laptop. Give admins separate, locked-down machines.
• Treat recruiting messages as an attack path. Binance has said a fake job interview led to malware. Have staff run unknown files or coding tests only in disposable environments, never on a work machine.
• Teach staff to report odd requests fast. Early reports can shrink the damage.

Slow down big moves

• Set withdrawal limits and delays. A 20-minute drain is hard to stop if nothing slows large transfers.
• Require a second person for large transactions.
• Alert on bursts. Dozens of large moves in minutes should trigger an alarm.

Plan for the day after

• Write an incident plan. Decide who freezes accounts, who calls the lawyers, and who talks to customers.
• Know your reimbursement exposure. Binance's pledge to cover losses shows how fast the cost question becomes central.
• Expect your story to change. Binance's explanation grew over several days. Say what you know, label what you don't, and update openly.

Source: BleepingComputer report on Binance's fake job interview statement, November 3, 2026; Binance Square preliminary statement; Richard Teng's post on X

Frequently Asked Questions