The Binance hack has been linked to North Koreas Lazarus Group by blockchain investigators, who suspect the state-backed hackers stole approximately $6.3 billion from the cryptocurrency exchange on October 29.
According to TRM Labs, its investigators have attributed the attack to TraderTraitor, a North Korean hacking unit associated with Lazarus, with high confidence. Blockchain investigator ZachXBT separately identified Lazarus as the likely attacker, although Binance has not confirmed who carried out the theft.
In comments to crypto.news, Ido Ben-Natan, co-founder and CEO of blockchain security firm Blockaid, said the attack surpassed previous cryptocurrency thefts in scale.
“This is the biggest crypto hack in history. Our analysis shows at least $3.5 billion moved out of Binance hot wallets on Ethereum, Arbitrum, Optimism and Avalanche in under an hour, more than double the Bybit theft in February 2025,” Ben-Natan said.
He noted that investigators had identified additional transfers involving Bitcoin and Tron, while his team continued tracing the stolen assets.
Meanwhile, blockchain tracking platform Onchain Lens reported that the Binance attacker had transferred 17,260 ETH, worth roughly $38.82 million, to a new wallet amid concerns that the funds could be laundered through Tornado Cash or other cryptocurrency mixers.
As per the tracker, the attacker still controlled almost 480,720 ETH, valued at $1.08 billion, which cannot be frozen by a token issuer. The receiving wallet was identified as 0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea.
BINANCE HACKER PREPARING TO LAUNDER FUNDS
The hacker just moved 17.26K $ETH ($38.82M) to a new wallet, preparing to launder funds via Tornado Cash and other mixers.
The attacker still holds 480.72K $ETH (~$1.08B) that cannot be frozen.
New wallet:… pic.twitter.com/FmG18g85hT
— Onchain Lens (@OnchainLens) October 30, 2026
Lazarus Group suspected as Binance hack reaches ten blockchains
TRMs investigation traced about $6.36 billion leaving Binance-controlled wallets across ten blockchain networks, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger.
Most of the stolen funds were moved in a span of about 20 minutes, beginning at 20:05 UTC. Around $3.79 billion was transferred on Ethereum, while Bitcoin and Tron accounted for another $1.47 billion and $628 million, respectively.
Investigators identified 233.46 million XRP, worth nearly $296 million, leaving five Binance wallets before the Ethereum attack began.
The security firm said preparations started at least 36 hours before the theft. An attacker-controlled wallet received three small Tornado Cash withdrawals and tested malicious code before targeting Binance.
TRM linked the activity to TraderTraitor using blockchain transactions and other intelligence, although it did not publicly disclose all the evidence behind its attribution.
The FBI has previously identified that TraderTraitor was responsible for the February 2025 Bybit theft where approximately $1.5 billion was drained from the exchange. U.S. authorities have accused North Korean hacking operations of stealing cryptocurrency to help finance the countrys weapons programs.
Blockaid explains how attackers accessed Binance wallets
Blockaid‘s technical investigation identified an unusual Ethereum transaction containing 50 EIP-7702 authorizations targeting Binance 14, one of the exchange’s busiest hot wallets.
EIP-7702 allows an Ethereum wallet to authorize smart contract code to operate on its behalf. The attacker prepared authorizations using 50 consecutive transaction counters, increasing the chance that one would match the wallets current counter.
Only one authorization succeeded, allowing a malicious contract to transfer assets from the wallet.
“The attacker effectively reprogrammed a major Binance Ethereum hot wallet so that a single operator could drain it, including any new money deposited into it,” Ben-Natan explained to crypto.news.
The attacker transferred approximately $2.5 billion from Binance 14, including 167,464 ETH and more than 1.6 billion USDT. Subsequent transfers targeted newly received funds.
Investigators found other Binance wallets moving assets through ordinary signed transactions across several networks. TRM believes the attacker may have gained access to the exchanges transaction-signing infrastructure.
Binance identifies possible laptop compromise as $3 billion frozen
In its security update, Binance said its initial investigation pointed to a compromised DevOps engineers laptop that may have allowed unauthorized access to an internal service container.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineers laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
— Binance (@binance) October 30, 2026
The exchange found no evidence of leaked private keys and said it would publish a detailed investigation once the cause was established.
Tether CEO Paolo Ardoino confirmed freezing more than 1.567 billion USDT, while Circle CEO Jeremy Allaire reported freezing over 800 million USDC. The Arbitrum Security Council secured approximately 74.6 million ARB and 8,425 ETH linked to the attacker.
Binance withdrawals remain paused
Binance has pledged to cover losses using its SAFU fund and company resources while working with law enforcement and blockchain investigators.
At the same time, the exchange said deposits remained operational, but withdrawals would stay paused while it upgraded withdrawal systems and address controls.
Binance expects withdrawals to resume within 48 hours and said a full report on the attacks cause will follow.
Cryptocurrency markets also came under selling pressure following the hack, with Bitcoin briefly falling below $77,000. Total liquidations across the derivatives market exceeded $1.5 billion over 24 hours.