The cryptocurrency industry is facing what could be the largest crypto theft in history. On October 29, 2026, approximately $6.36 billion in cryptocurrency was transferred out of wallets belonging to Binance, the world’s largest cryptocurrency exchange.
The attack unfolded across multiple blockchain networks, with the bulk of the stolen assets moving within approximately 20 minutes. Blockchain intelligence firms have attributed the attack with high confidence to North Korea’s state-linked hacking group known as TraderTraitor.
But the theft itself is only part of the story. What happened afterwards is even more fascinating: an enormous attempt to convert, move and protect billions of dollars in cryptocurrency before investigators and stablecoin issuers could intervene.
How Did Hackers Get Into Binance?
Binance’s initial investigation suggested that the attack may have involved a compromised laptop belonging to a DevOps engineer.
According to the exchange, the attacker gained access to an internal service container and used it to submit unauthorised withdrawal transactions.
Importantly, Binance initially reported that it had found no evidence that wallet private keys had been leaked.
This distinction matters.
Rather than necessarily stealing the keys themselves, investigators believe the attackers manipulated systems that were authorised to sign and process transactions. In other words, they appear to have abused Binance’s own infrastructure to move cryptocurrency into attacker-controlled wallets.
Blockchain investigators identified unusual transaction-signing activity across multiple networks.
On Ethereum, TRM Labs identified the use of an EIP-7702 delegation, which allowed a Binance hot wallet to execute code through a smart contract controlled by the attacker. The investigation identified 50 pre-signed authorisations prepared for the operation.
Binance later described the incident as a complex attack involving additional points of breach. The full technical post-mortem has not yet been published.
$6.36 Billion Moved Across Multiple Blockchains
The attackers did not concentrate on a single cryptocurrency or blockchain.
According to TRM Labs and Elliptic, assets were taken across ten blockchain networks, including:
- Ethereum
- Bitcoin
- TRON
- XRP Ledger
- Solana
- Arbitrum
- Avalanche
- Polygon
- Optimism
- Base
Ethereum accounted for the largest portion of the theft, with approximately $3.8 billion in cryptocurrency taken.
The attackers also obtained approximately 18,270 Bitcoin, worth around $1.48 billion at the time of the theft.
This was not simply a case of transferring money from one wallet to another. The attackers had to deal with different blockchain networks, different tokens and different mechanisms for converting and moving assets.
And that is where the laundering operation began.
How Did They Try to Launder the Stolen Cryptocurrency?
Once the stolen assets reached attacker-controlled wallets, investigators identified several decentralised exchanges, swap services and DeFi protocols being used to move or convert the cryptocurrency.
Rather than relying on one platform, the attackers used different services across Ethereum and TRON.
1. Uniswap and 1inch: Converting USDT Into Ethereum
On Ethereum, investigators identified approximately $434 million in USDT being exchanged for around 160,451 ETH through Uniswap, 1inch and market-maker request-for-quote systems.
The swaps came at a considerable cost. Elliptic estimated that the attacker accepted losses of approximately 12–26% compared with prevailing market prices.
This suggests speed was more important than getting the best possible exchange rate.
The attacker was effectively exchanging stablecoins for cryptocurrency that could not simply be frozen by a stablecoin issuer.
2. SunSwap: Converting USDT Into TRON
The investigation also identified substantial activity on the TRON blockchain.
Approximately $234 million in USDT was exchanged for around 638 million TRX through SunSwap.
The TRX was subsequently distributed across several new wallets.
Some of those funds were later moved in smaller amounts through additional swap services and bridges.
3. Aave: Borrowing Against Stolen Cryptocurrency
Another interesting part of the operation involved Aave, one of the largest decentralised lending protocols.
Investigators identified an attacker-controlled wallet that deposited approximately $59.9 million in USDT as collateral.
Using that collateral, the wallet borrowed approximately 19,762 ETH.
This is different from a normal token swap.
The attacker was using one cryptocurrency as collateral to obtain another asset, introducing another layer of complexity into the movement and recovery of the funds.
Aave subsequently froze the affected markets to prevent further activity. However, freezing market activity is not the same as automatically confiscating the collateral or seizing the attacker’s assets.
4. Cross-Chain Transfers and Additional Swaps
Investigators also identified activity involving Avalanche and Ethereum.
According to Elliptic, stolen AVAX was converted into USDC, transferred to Ethereum using Circle’s Cross-Chain Transfer Protocol, and exchanged for approximately 7,242.8 ETH.
This illustrates how the operation extended beyond simple swaps on decentralised exchanges.
However, investigators have not established that all stolen assets passed through bridges, mixers or centralised exchanges. Large portions were still sitting in wallets identified by blockchain analysts.
The Battle to Freeze the Money
The attackers faced one significant problem: some cryptocurrencies are much easier to freeze than others.
Stablecoins such as USDT and USDC have centralised issuers that can blacklist specific wallet addresses.
Bitcoin and native Ethereum do not have a central issuer with the ability to freeze arbitrary wallets in the same way.
That distinction became critical during the investigation.
Tether froze nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million. Other issuers and the Arbitrum Security Council also intervened.
Binance reported that approximately $3 billion had been frozen or secured on-chain.
Elliptic independently verified approximately $2.84 billion in frozen funds in its October 30 investigation snapshot. TRM Labs reported approximately $2.7 billion in frozen or secured assets.
These figures differ because of reporting times, valuation methods and which assets are included.
The intervention significantly complicated the attackers’ attempt to move the money.
Who Is Behind the Binance Hack?
Blockchain intelligence firms TRM Labs and Chainalysis have pointed towards North Korea’s TraderTraitor hacking group.
TRM says it attributes the attack to the group with high confidence, based on on-chain and off-chain intelligence.
The suspected involvement is particularly significant because North Korean hacking groups have been linked to several major cryptocurrency thefts.
The February 2025 Bybit hack, involving approximately $1.5 billion, was attributed by the FBI to North Korea.
Cryptocurrency theft is considered an important source of foreign currency for the isolated country, which faces extensive international sanctions.
Binance has said it is working with law enforcement to establish the identities of those responsible. North Korea’s involvement has not been independently confirmed by the exchange.
How Much Money Did the Hackers Actually Keep?
Despite the extraordinary scale of the theft, stealing $6.36 billion does not mean the attackers can simply withdraw that amount as cash.
Blockchain transactions are publicly recorded, allowing investigators to follow stolen assets as they move between wallets.
At the time of TRM Labs’ October 30 reporting snapshot, the attackers still controlled more than 420,000 ETH and approximately 18,270 BTC, together worth around $2.4 billion.
These assets are particularly difficult to freeze because they do not have centralised token issuers.
Elliptic also tracked movements between wallets, including Bitcoin being split across multiple addresses.
At the time of the investigation, there was no evidence that the entire remaining balance had successfully been converted into traditional currency.
Moving cryptocurrency is not the same as successfully cashing it out.
Any attempt to sell large amounts of stolen cryptocurrency creates additional opportunities for exchanges, liquidity providers and investigators to identify and block the funds.
Binance Says Customer Funds Are Safe
Despite the enormous theft, Binance has stated that customer funds remain safe.
The exchange has committed to covering all losses using its Secure Asset Fund for Users (SAFU) and company funds.
Binance also said it would publish updated Proof of Reserves information after completing its remediation work.
Withdrawals were temporarily suspended while the company reviewed its security infrastructure. Deposits were subsequently reported to remain operational.
The incident nevertheless raises serious questions about the security of centralised cryptocurrency exchanges and the systems responsible for approving withdrawals.
Even when private keys are not directly stolen, compromised internal systems can potentially create a pathway to enormous financial losses.
The Bigger Picture: The World’s Largest Crypto Heist
The Binance incident demonstrates both the strengths and weaknesses of the cryptocurrency ecosystem.
On one hand, blockchain transparency allowed investigators to follow billions of dollars across multiple networks. Stablecoin issuers and blockchain security organisations were also able to intervene and freeze substantial amounts.
On the other hand, decentralised assets such as Bitcoin and native Ethereum cannot simply be frozen by a central issuer.
The attackers reportedly moved billions within minutes, used multiple swap platforms, borrowed against stolen assets and distributed cryptocurrency across different wallets.
But the biggest question remains unanswered.
Can the hackers actually turn billions of dollars in traceable cryptocurrency into money they can spend without being caught?
That is the next chapter of this investigation.
Crypto Cobra will continue following the money as new blockchain movements, investigative findings and official statements emerge.
Sources and Further Investigation
The following organisations have published primary investigations and reporting on the incident:
- Binance – Official Security Incident Update
- TRM Labs – North Korea Steals $6.36 Billion From Binance
- Elliptic – The Largest Theft in History: Binance Hack Investigation
- Bitquery – Binance Hack: On-Chain Investigation
- Reuters – Hackers Steal $6.3 Billion From Binance
- Associated Press – Blockchain Firms Link North Korea to Binance Hack
Information and blockchain figures reflect reporting available on October 30, 2026. The investigation is ongoing, and figures may change as additional transactions are identified.
