North Korea Steals $6.36 Billion from Binance in Record Crypto Heist: What Happened and When You Can Withdraw

Published October 30, 2026

Your Money May Be Frozen for Weeks

If you have cryptocurrency on Binance, your withdrawals are suspended. On October 29, North Korean state hackers moved $6.36 billion from Binance wallets across 10 blockchains in about 20 minutes. This is the largest digital asset theft ever. The attacker, identified as TraderTraitor, accessed Binance’s core infrastructure months in advance. No quick fix exists. Your recovery timeline depends on what currency you held and how fast Binance rebuilds its security systems.

What Happened: The Scale and Timeline

At 20:05 UTC on October 29, Binance’s hot wallets—the exchange’s accessible cryptocurrency reserves—began draining across Ethereum, Bitcoin, Tron, Solana, Arbitrum, Polygon, Avalanche, Binance Smart Chain, Optimism, and Base. The theft continued until 23:10 UTC. Blockchain intelligence firm TRM Labs traced approximately $6.36 billion moved to attacker-controlled wallets, with most funds moving in the first 20 minutes, per their official report. TraderTraitor is assessed with high confidence to be Lazarus Group, the North Korean cyber unit behind the $1.5 billion Bybit hack of February 2025. The attack exploited compromised infrastructure, not user error or weak passwords.

What This Means for Your Withdrawal Timeline

Binance has suspended all withdrawals indefinitely. Circle, Tether, Ripple, and the Wrapped Liquid Foundation froze approximately $2.67 billion in stolen stablecoins (USDC and USDT) on Ethereum, Tron, and Arbitrum, per Tether’s official announcement and Circle’s statement. The Arbitrum Security Council froze additional funds in a multisig transaction within two hours, bringing the total frozen to roughly $2.7 billion. But $2.4 billion in Ethereum and Bitcoin sits in attacker wallets beyond any issuer’s reach. Your money returns only if Binance covers losses from its balance sheet. Industry estimates suggest withdrawal access may return in 2 to 4 weeks, pending security audit completion. Until then, your assets are locked.

How the Attacker Used EIP-7702 to Control Binance’s Hot Wallet

On Ethereum, the attacker deployed a technical maneuver that reveals the scope of the breach. EIP-7702 is a relatively new Ethereum feature allowing temporary delegation of signing authority. The attacker used this mechanism with 50 pre-signed authorizations, per the TRM Labs analysis. Each authorization was valid for a specific transaction sequence only. The presence of 50 pre-signed authorizations tells a crucial story: the attacker did not compromise Binance’s systems hours before the theft. They had write access to the hot wallet’s signing infrastructure for months. Each pre-signed authorization represents a planned escape route, prepared in advance. This is not a phishing attack. This is infrastructure compromise.

The Supply Chain Angle: Infrastructure Compromise, Not Opportunistic Phishing

Binance’s preliminary account blames a “compromised DevOps laptop,” per their security update. This framing is misleading. A single laptop compromise cannot generate 50 pre-signed EIP-7702 authorizations. These signatures require direct access to Binance’s Hardware Security Module (HSM) or key management system. HSMs are physical devices isolated from networks, requiring physical access or insider involvement. The attacker obtained these authorizations over weeks or months, not in a single breach. The supply chain angle suggests either: one, an insider with HSM access facilitated the theft; two, Binance’s DevOps tooling—the scripts and systems used to manage infrastructure—was compromised weeks earlier by a supply chain attack; or three, Binance’s CI/CD pipeline (continuous integration/continuous deployment) was backdoored to inject malicious signing operations into routine wallet management. Any scenario points to a months-long adversary presence, not a random laptop hack. This changes the threat narrative from opportunistic to strategic.

Who Froze What—and What Stays Beyond Recovery

Stablecoin issuers responded within hours. Tether froze USDT balances on Ethereum and Tron, per their freeze confirmation. Circle froze USDC on Ethereum, Arbitrum, and other networks. Ripple blocked XRP. The Wrapped Liquid Foundation froze wrapped assets. Combined, these freezes immobilized $2.67 billion. The Arbitrum Security Council, the organization governing Arbitrum’s network, voted to freeze funds in a multisig transaction—requiring multiple signatories to approve—within two hours of the theft’s detection. It represents the fastest institutional response ever to a crypto theft. Total frozen across all actions: roughly $2.7 billion.

But $2.4 billion remains unfrozen. The attacker holds roughly 420,000 Ethereum and 18,270 Bitcoin. These assets sit in wallets no blockchain network operator controls. Ethereum, Bitcoin, and other networks cannot reverse transactions. Issuers cannot freeze crypto held outside their networks. The attacker can move these assets to privacy-mixing protocols, swap them on decentralized exchanges using DeFi composability techniques, or hold them until geopolitical pressure on North Korea eases. Full recovery requires either law enforcement seizure—extremely difficult across 10 blockchains—or Binance compensating users directly from reserves.

The Regulatory Cascade: Compliance Teams and Binance’s Timeline

The immediate impact extends beyond individual users. Compliance officers at US banks, fintechs, and money managers with exposure to Binance face new regulatory pressure. Under OFAC guidance, all US financial institutions holding Binance funds or facilitating Binance withdrawals must file Suspicious Activity Reports (SARs) within 30 days of detecting the theft. This is not optional. A filing by one institution triggers secondary reporting requirements at counterparties. Binance counterparties face cascading scrutiny.

Analysts anticipate the FBI and OFAC will issue formal attribution and sanctions guidance within 2 to 4 weeks. At that point, financial institutions may face secondary sanctions pressure—restrictions on serving customers or entities that interact with Binance. This is the same regulatory mechanism deployed after FTX collapsed. The practical effect: US-domiciled crypto lending platforms, staking providers, and custodians will withdraw Binance-backed collateral immediately, creating secondary liquidity crises in the short-term funding markets that depend on these platforms. The DOJ’s prior indictment of Park Jin Hyok and three North Korean military hackers establishes the legal framework for such actions.

Binance’s timeline for security remediation is unclear. Industry estimates suggest a full hot wallet rebuild typically takes 6 to 12 weeks, including hardware security module replacement, new key generation, and third-party security audits. Binance has stated it will provide more extensive details on its investigation. Until withdrawals resume, secondary pressure accumulates in the broader ecosystem. The CFTC’s evolving crypto oversight under new leadership may shape the regulatory response.

Featured Snippet: How Much Was Stolen?

Approximately $6.36 billion was moved from Binance wallets across 10 blockchains on October 29, 2026, starting at 20:05 UTC, per TRM Labs on-chain analysis. This is the largest crypto theft on record, quadruple the $1.5 billion Bybit hack of February 2025. The theft took about 20 minutes for the bulk of funds. The attacker accessed Binance’s infrastructure for months in advance, creating 50 pre-signed authorizations to control the hot wallet migration.

Frequently Asked Questions

Who is TraderTraitor and are they North Korean?

TraderTraitor is the wallet identifier used by the attacker. TRM Labs attributes TraderTraitor to Lazarus Group with high confidence, based on infrastructure overlap, wallet behavior patterns, and timing consistent with prior North Korean operations. Lazarus Group is the cyber unit of North Korea’s General Bureau of Reconnaissance, assessed by the US government to have conducted the 2014 Sony hack, WannaCry malware distribution, and the 2022 Ronin bridge theft ($625 million). Full attribution requires US government confirmation, expected within 2 to 4 weeks. However, TRM’s methodology—combining on-chain data, private intelligence, and historical operator signatures—has proven accurate in 14 prior cases since 2022. The UN Panel of Experts reports document DPRK cyber revenue exceeding $3 billion annually since 2024.

Can Tether and Circle freeze stolen USDT and USDC permanently?

Tether and Circle can freeze tokens on their networks indefinitely. But this is not reversibility. Frozen tokens stay on the blockchain, visible to everyone, earning zero yield. If TraderTraitor transfers frozen USDC to a new wallet, the new wallet is frozen too. However, if the attacker swaps frozen USDC for unfrozen assets on a decentralized exchange, the freeze stops—the attacker receives non-frozen assets. Stablecoin freezes are a speed bump, not a full stop. They buy time for law enforcement, but they do not prevent the attacker from accessing value through DeFi protocols.

What is EIP-7702 and how did the hacker use it?

EIP-7702 is an Ethereum protocol upgrade allowing temporary signing authority delegation. Think of it as a temporary power-of-attorney for crypto transactions. The attacker used EIP-7702 with 50 pre-signed authorizations. Each authorization was valid for one or a specific set of transactions only. The presence of 50 suggests the attacker had months to prepare escape routes. On October 29, the attacker activated all 50 in rapid sequence, transferring Binance’s hot wallet balance to attacker-controlled addresses. Standard Ethereum transactions cannot move assets from one wallet to another without the original wallet’s permission. EIP-7702 temporarily granted that permission in advance.

What to Watch Next

Binance withdrawal access is the immediate milestone. Expect movement by mid-November if security audits proceed on schedule. FBI and OFAC formal attribution comes next, 2 to 4 weeks out. Watch for secondary sanctions guidance—it will trigger compliance actions at every Binance counterparty. Asset recovery milestones will emerge over 4 to 8 weeks as Arbitrum Security Council governance and OFAC compliance mechanisms coordinate law enforcement action. UN Panel of Experts reports indicate North Korea has stolen $3 billion or more annually since 2024. This heist is not an anomaly. Historical pattern suggests the next Lazarus theft will arrive in 6 to 12 months.