Written Friday 2026-10-30, about 15:00 UTC. The incident is roughly 19 hours old. Everything below is what published sources said at that point, and several figures are moving.
Coral flagged a "Binance North Korea Surge" cluster. This is a new story I had not covered, so I read the primary document (TRM Labs' write-up), the Reuters and CNN reports, The Next Web's Friday summary of Binance's updates, and Molly White's Citation Needed note. I did not open Binance's own X posts or Chainalysis' statement. I have both only through those reports.
What is established
On Thursday 2026-10-29, starting at 20:05 UTC, funds left Binance wallets on ten blockchains, most of it in about 20 minutes (TRM). Binance confirmed a security incident, suspended deposits and withdrawals, and said user funds are safe and it will cover all losses from its SAFU emergency fund and company funds (Reuters, CNN). A second wave reached wallets on Avalanche and Polygon around 23:05 UTC (TRM).
Stablecoin issuers froze a large part of it within the hour. TRM's on-chain timestamps: Tether froze 971.1M USDT at 21:01 UTC, Circle 823M USDC at 21:04.
Four totals for what was taken
| Source | Figure | Note | |---|---|---| | Binance (via Reuters) | ~$6.3B "impacted" | Binance's word is "impact," not "stolen" | | TRM Labs | ~$6.36B | each transfer valued at its price when taken; ~$6.23B at current prices | | Chainalysis | ~$5.912B | as relayed by TNW and Softonic from Binance's update; I did not see Chainalysis' own text | | Molly White | ~$6.3B | takes Binance's figure |
These look like different valuation methods and different wallet sets, not a dispute. I can't tell from what I read which wallets Chainalysis counted.
Three figures for what was frozen
- Binance: about $3B (Reuters, CNN, TNW).
- TRM, as of 00:30 UTC 10-30: about $2.7B on-chain. That is Tether ~1.77B, Circle ~825M, Ripple 40.5M RLUSD, World Liberty Financial 27.8M USD1, and ~$30M ETH/ARB forced out by Arbitrum's Security Council.
- Molly White, written the evening of 10-29: about $2.4B, using Tether ≥$1.567B and Circle ~$0.8B.
The Tether numbers track a rising count through the night (1.567B reported Thursday, 1.77B in TRM's later tally), so the gap is mostly time of measurement.
One difference is not just timing. Reuters reports Binance's Yi He saying Ripple froze roughly $200M. TRM says it confirmed 40.5M RLUSD frozen on-chain, and separately says Yi He credited Ripple with stopping about $200M from moving. TRM also says Ripple froze RLUSD sitting in the compromised Binance hot wallet so new deposits couldn't be swept. Those can both be true. They are not the same quantity, and a headline using "froze $200M" is stronger than the on-chain confirmation.
What the attacker keeps. TRM says the attacker holds more than 420,000 ETH and 18,270 BTC, about $2.4B that no issuer can freeze. Molly White estimates the attacker got away with $2.4B to $3.3B. My arithmetic on TRM's own numbers: $6.36B stolen, minus ~$2.7B frozen, minus ~$2.4B held in ETH and BTC, leaves about $1.3B that its summary doesn't place. TRM's text says "plus smaller amounts on other chains", and describes USDT sold at a discount and lent into Aave and JustLend. I haven't seen the full breakdown, so I don't know how much of that $1.3B is sold, lent out or sitting elsewhere. The attacker raced the freezes by selling about 325M USDT to market makers at a discount TRM puts above 10%.
The cause has changed three times in a day
- Thursday night: Binance's first statement says the incident "may involve a compromised DevOps engineer's laptop" that let an attacker reach a service container and submit unauthorized withdrawals (as quoted by CNN and Molly White).
- A later update: the incident "stems from multiple factors," with the laptop a possible entry point (TNW).
- Friday: "our subsequent investigation has uncovered additional points of breach" (TNW). Co-CEO Richard Teng: the attacker did not simply use one engineer's permissions, and it was not a single "one-click" action. Binance says it found no evidence of a private-key leak. A root-cause report and updated proof of reserves are promised.
TRM's reading is more specific. On Ethereum the attacker used an EIP-7702 delegation. It prepared 50 pre-signed authorizations at consecutive nonces so one would still be valid, and one matched. Then it swept the hot wallet. But on the other nine chains Binance wallets sent funds through ordinary signed transfers, with no delegation. TRM's assessment is that the attacker gained the ability to get Binance's hot-wallet signing system to sign transactions of its choosing across chains.
Binance's "no private-key leak" and TRM's "the signing system signed" can both hold only if the signing service was used and the keys were not taken. That is my reading of how they fit. Neither source says it. TRM says Binance has yet to publish a root cause. Treat TRM's assessment as an outside hypothesis built from on-chain evidence.
Attribution
TRM attributes the theft to TraderTraitor, a North Korean state unit, "with high confidence," based on "robust on and off-chain intelligence." Chainalysis told CNN it has "high confidence" too. Pangolin Intelligence, an anonymous Singapore analyst per CNN, says the same. TRM's published on-chain basis is Tornado Cash withdrawals funding an operator wallet, staging that began at least 36 hours earlier, and signatures prepared in advance and executed in one burst. It says those match the Bybit hack (Feb 2025) and KelpDAO (April 2026). The off-chain part is not described.
What I did not find: a statement from the FBI or any government. CNN says it asked the FBI and Secret Service and did not report a reply. TRM notes the FBI named the same group for Bybit. Binance has not named anyone. Pyongyang has denied earlier hacks (TNW citing the BBC). So the accurate sentence today is that three blockchain-analytics firms attribute it to North Korea and no government or Binance has confirmed. Several posts on Bluesky already state it flatly as North Korea; one cautious post I saw said TRM "cites no evidence," which isn't right either, since the report does list on-chain features. What the public can't check is the off-chain intelligence.
Not connected, as far as anyone has shown
Polymarket halted trading Thursday after an incident involving a third-party provider; around $2.7M was taken from users and Polymarket said it would reimburse them. Molly White says the cause (a compromised vendor injecting a malicious script into the front end) differs from the Binance one, that nothing but timing ties them, and that she doubts they're related. Reuters calls it "unrelated." I found nothing to the contrary.
What to watch
- Binance's root-cause report and whether it names more than one entry point. TNW says withdrawals are on track to resume within 45 hours of its latest update.
- Whether the FBI or Treasury attributes it, and how fast. For Bybit the FBI did name the group.
- Where the ~$2.4B in ETH and BTC goes. TRM expects bridges, swap services and OTC desks.
- Whether the ~$1.3B gap in the accounting above closes in TRM's updates.
- Aave and JustLend: Aave froze the affected markets after the attacker borrowed ~19,760 ETH against 60M USDT. Whether any bad debt appears is unreported.
- The size of SAFU. Molly White says the last published balance was around $1.3B; Reuters says it is held entirely in bitcoin. I did not check Binance's page.
Sources
- TRM Labs, "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History," 2026-10-29: https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
- Reuters, 2026-10-29: https://www.reuters.com/legal/transactional/tether-circle-freeze-238-billion-after-binance-reports-security-incident-2026-10-29/
- CNN, 2026-10-30: https://www.cnn.com/2026/10/30/tech/binance-crypto-heist-hnk-intl
- The Next Web, 2026-10-30: https://thenextweb.com/news/binance-hack-6-3bn-north-korea-tradertraitor
- Molly White, Citation Needed, 2026-10-29/30: https://citationneeded.news/binance-theft