$6.36 billion vanished from Binance wallets in roughly 20 minutes on the evening of October 29, making it the largest single theft in the history of digital assets, according to blockchain analytics firms TRM Labs and Chainalysis.

The operation began at 8:05pm UTC. TRM Labs, attributing the attack "with high confidence" to TraderTraitor, a subunit of North Korea's Lazarus Group, said preparations had started at least 36 hours before the first transfer fired. Attackers used 50 pre-signed authorisations to convert a Binance hot wallet on the Ethereum network into a sweeper contract under their control, exploiting Ethereum Improvement Proposal 7702 delegation, then spread simultaneously to nine further blockchains. TRM Labs told CNBC the attackers had seeded their wallets ahead of time using Tornado Cash, a cryptocurrency mixing service.

The haul crossed 10 chains: roughly 200,630 ETH and 185 other tokens on Ethereum, including $1.875 billion in USDT and $823 million in USDC; 18,270 BTC worth approximately $1.47 billion on Bitcoin; 612.7 million USDT and 46.4 million TRX on Tron; 233.46 million XRP on the XRP Ledger; and 970,500 SOL on Solana, plus balances on Arbitrum, Optimism, Base, Avalanche and Polygon, according to TRM Labs.

Stablecoin issuers moved fast. Tether froze assets at 9:01pm UTC, 56 minutes after the raid began, according to TRM Labs. Circle, Ripple and World Liberty Financial, a crypto venture backed by US President Donald Trump's family, followed, together immobilising approximately $2.67 billion in fiat-backed stablecoins. The Arbitrum Security Council froze a further 8,426 ETH and 74.6 million ARB. Binance later put the total frozen at approximately $3 billion.

The hackers had anticipated the response. Before issuers could act, they converted unblacklisted stablecoins through automated market makers and borrowed native Ether by depositing tokens into the Aave lending protocol, until Aave froze those markets. TRM Labs calculated that the attackers retained approximately $2.4 billion in unfreezable base assets: more than 420,000 ETH and the full 18,270 BTC.

Binance co-CEO Yi He said the firm's Secure Asset Fund for Users would backstop all losses. Co-CEO Richard Teng, quoted by the BBC, said the attackers had deployed "a self-destruct mechanism that destroyed tooling and traces as they went." Sean Farrell at Fundstrat Global Advisors estimated the SAFU fund at approximately $1.2 billion, enough to cover roughly a third of the gap once frozen stablecoins are returned, with Binance's own reserves expected to absorb the rest. Several experts, including Daniel Tunkel of London's Edwin Coe law firm, warned the BBC that customers should not regard Binance's promise to cover losses as legally binding; Tunkel said recovery would "come down to what [customers] have been promised in their contracts" and whether Binance could be sued for non-performance.

The Bybit heist in February 2025, attributed by the FBI to the same TraderTraitor unit, cost $1.5 billion. TRM Labs said the Binance theft is roughly four times larger. Chainalysis had estimated in December 2025 that North Korean hackers stole approximately $2 billion in cryptocurrency that year, itself then a record. Chainalysis co-founder and chief executive Jonathan Levin told CNBC his firm assessed the hack was likely carried out by TraderTraitor, citing links to previous attacks.

Crypto markets absorbed the shock overnight. Bitcoin fell more than 3 per cent to $76,368, Ether dropped 3.2 per cent to $2,178, and BNB shed roughly 5 per cent, according to Brussels Signal. The breach arrives as Binance already faces EU regulatory scrutiny: the exchange did not obtain a licence under the Markets in Crypto-Assets Regulation before the July 1 deadline and now serves European customers from an Abu Dhabi entity, with regulators in France, Germany and Greece examining its reliance on a reverse solicitation exemption, the Financial Times reported on October 1, as cited by Brussels Signal.

A state apparatus spent 36 hours building the mechanism, then needed 20 minutes to empty the vault. Binance spent the rest of the day reassuring its more than 300 million registered users that their money was safe.