Twenty minutes at Binance: how the biggest theft in history worked
Drop this at dinner: North Korea's whole export economy is under half a billion dollars a year, and on Thursday night its hackers took six billion from Binance in about twenty minutes.
At 20:05 UTC on Thursday 29 October 2026, money began leaving Binance, the world's largest cryptocurrency exchange, on ten blockchains at once. By 20:23 its main Ethereum hot wallet was empty. The haul was about $6.36 billion at the prices of the moment: roughly $3.79 billion on Ethereum, including 200,630 ether and 1.875 billion Tether dollars; 18,270 bitcoin worth about $1.47 billion; about $628 million on Tron; $296 million in XRP; $96 million in Solana; and smaller sums on Arbitrum, Optimism, Base, Avalanche and Polygon. It is four times the previous record, the $1.5 billion taken from Bybit in February 2025, and the blockchain analysts TRM Labs, Chainalysis and Elliptic all attribute it with high confidence to TraderTraitor, the unit of North Korea's Lazarus Group that specialises in exchanges and was blamed by the FBI for the Bybit theft.
A theft of keys, not code
An exchange keeps most customer money offline in cold storage and a working float in hot wallets, whose keys sign withdrawals automatically. Binance's initial account is that the attackers compromised a DevOps engineer's laptop, moved from there into a service container, and from there reached the system that does the signing. No private key appears to have been copied; the key was simply made to sign things it should not have.
On Ethereum the attackers used EIP-7702, a feature added to the network in the Pectra upgrade of May 2025 that lets an ordinary wallet hand its behaviour to a smart contract on the strength of one signed authorisation. They submitted fifty such authorisations, each for a different transaction count, so that whatever the wallet's count had reached one of them was certain to be valid. The contract they pointed the wallet at was a sweeper that only they controlled. On the other nine chains the money left by ordinary signed transfers. Preparation had begun at least 36 hours earlier, with small withdrawals from the Tornado Cash mixer funding an operator wallet and a test run of the code. Binance's chief executive Richard Teng said the delegation did not pass through the company's normal approval controls and that the attacker used a self-destruct mechanism to remove traces.
The kill switch
What happened next has no equivalent in the old financial system. Dollar stablecoins are issued by companies that can freeze any token on request, and within hours Tether had frozen about 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD and World Liberty Financial 27.8 million USD1, while the Arbitrum Security Council froze a further $30 million. TRM Labs put the frozen total at about $2.7 billion by 00:30 UTC on 30 October; Binance's own verified figure reached $3 billion later that day.
The bitcoin and ether cannot be frozen by anyone. The 18,270 bitcoin were split through a peel chain into round lots of 1,000 and 100 coins. About 325 million USDT was sold on decentralised exchanges for ether at a discount of more than 10 per cent before the freezes caught up, a further 60 million was deposited on the lending protocol Aave to borrow about 19,760 ether, and 300 million on Tron was parked in JustLend. Chainalysis reported thousands of automated transactions cycling funds through fresh addresses. At the end of the first day the thieves still held about $2.4 billion, including more than 420,000 ether and all of the bitcoin.
Binance suspended deposits and withdrawals just after midnight on 30 October. Teng said the company would cover every loss from its own funds and its SAFU emergency reserve: it set aside more than $6.34 billion, of which $5 billion was already held in the same tokens that were stolen, with the rest bought on the market and over the counter. It aimed to restore withdrawals by Sunday 1 November and to publish a full proof of reserves by Monday. Bitcoin nonetheless fell to a six-week low near $77,000, down about 8 per cent for October, and crypto liquidations reached $1.5 billion.
The theft against the thief
The scale is best measured against the country accused of it. North Korea's recorded exports for the whole of 2025 came to $468.6 million, the highest since 2017, with 98 per cent of its trade going to China. Its hackers stole $2.02 billion of cryptocurrency that year according to Chainalysis, about 60 per cent of everything stolen worldwide, and Western estimates put roughly 40 per cent of the proceeds into the country's weapons programmes. Thursday's haul, before any freezes, was about thirteen and a half years of North Korea's exports in twenty minutes. Even the unfrozen $2.4 billion is five years' worth.
Sources
This piece was drafted by AI from the public sources named, then read and approved by Michael Rossi before it went up. It explains how something works; it is not advice of any kind.
← Back to StreetOwl