How North Korean Hackers Stole $6.4 Billion from Binance in 20 Minutes

The $6.4 Billion Binance Hack: Inside the Biggest Crypto Fraud in History

Welcome back to Gadget Newz. The cryptocurrency industry was recently shaken by an unprecedented security breach. On October 29, 2026, Binance – the world’s largest cryptocurrency exchange – suffered a catastrophic exploit, resulting in the loss of approximately $6.36 to $6.4 billion. This incident is now officially the largest crypto theft on record, dwarfing the $1.5 billion Bybit hack of February 2025 by roughly four times.

Here is a complete breakdown of how this historic breach occurred, the highly sophisticated tactics used, and who authorities have named as the culprit.

Who is Behind the Binance Heist?

The FBI, alongside major blockchain intelligence firms like TRM Labs and Chainalysis, has attributed the attack to “TraderTraitor”. TraderTraitor is an elite, state-sponsored hacking unit operating out of North Korea. Current and former officials note that cybercrime is a major revenue stream for the heavily sanctioned nation, with these stolen funds likely funneling directly into state programs.

How Did the Hack Happen?

The sheer speed of the exploit is what makes it so alarming. The attackers managed to drain billions from Binance hot wallets across 10 different blockchains in a mere 20 minutes.

The breach points directly to a severe compromise of Binance’s hot wallet signing infrastructure. On the Ethereum network, the hackers utilized an advanced technique involving EIP-7702 delegation. By deploying 50 pre-signed authorizations prepared well in advance, the attackers transformed a Binance hot wallet into a malicious “sweeper” contract that only they could control. This allowed them to instantly drain the wallet and automatically sweep any new incoming funds.

The Power and Features of the Exploit

This was not a simple smash-and-grab; the hack featured highly sophisticated, automated money laundering capabilities.

• Rapid Asset Swapping: Knowing that centralized stablecoins can be blacklisted, the attackers raced against security freezes by instantly selling stolen USDT to market makers and using decentralized platforms like Aave to borrow Ethereum against their stolen stablecoins.
  
• Programmatic Laundering: Chainalysis noted that the laundering process showed heavy signs of automation. The hackers used repeated sequences, such as sending exactly 1 TRX to a new address to test it before automatically forwarding massive amounts of stolen funds.
  
• Peel Chains: The attackers employed “peel chains,” a technique that breaks large amounts of cryptocurrency into thousands of smaller transactions to make tracking the stolen assets significantly harder for law enforcement.

Are User Funds Safe?

Despite the massive loss, Binance successfully mitigated the damage for its everyday users. Within days, roughly $2.8 billion of the stolen funds had been successfully frozen by entities like Tether, Circle, and the Arbitrum Security Council. To cover the remaining multi-billion dollar deficit, Binance utilized its Secure Asset Fund for Users (SAFU), portions of its Futures Insurance Fund, and corporate treasury reserves, ensuring that no customers lost their personal holdings.

Watch BBC News cover the attribution of the hack here:

Frequently Asked Questions (FAQs)

1. When did the $6.4 billion Binance hack happen?
The attack began at approximately 20:05 UTC (4:20 p.m. ET) on October 29, 2026. The majority of the funds were drained within a 20-minute window.

2. Who hacked Binance in 2026?
The FBI and blockchain intelligence firms have attributed the hack to TraderTraitor, an elite North Korean hacking unit.

3. Is this the largest crypto hack in history?
Yes. At roughly $6.36 to $6.4 billion, this exploit is the largest crypto theft ever recorded, exceeding the previous $1.5 billion Bybit hack.

4. Did Binance users lose their money?
No. Binance temporarily paused withdrawals to secure the network but stated that user funds were safe. The company replaced the stolen tokens using its own treasury and the SAFU emergency fund.

5. Was any of the stolen cryptocurrency recovered?
Yes. Through rapid industry cooperation, stablecoin issuers like Tether and Circle, along with various network security councils, managed to freeze approximately $2.8 billion of the stolen assets before the hackers could launder them.