Inside the Minutes North Korean Hackers Needed to Drain Binance’s Hot Wallets

MakeCryippreferred on

• TRM Labs attributes the Binance theft to TraderTraitor, a North Korean hacking unit, with high confidence, citing staged Tornado Cash funding and rehearsal transactions ahead of the attack
• The attacker used a single Ethereum transaction containing 50 pre-signed EIP-7702 authorizations to convert a Binance hot wallet into a sweeper contract
• Binance wallets on nine other chains were drained through ordinary signed transfers within roughly 30 minutes, which TRM says points to a compromise of Binance’s hot-wallet signing infrastructure

Blockchain intelligence firm TRM Labs published its own forensic account of the Binance theft, estimating the total stolen at about $6.36 billion at the prices in effect when the assets were taken, or roughly $6.23 billion at current prices. TRM calls it the largest crypto theft on record, about four times the size of the $1.5 billion Bybit hack from February 2025.

TRM attributes the attack to TraderTraitor, a hacking unit it links to North Korea, with high confidence. The firm points to small Tornado Cash withdrawals that funded an operator wallet starting around October 28, followed by attack code that was tested and rehearsed on other wallets before the final version was deployed against a Binance hot wallet, a staging pattern TRM says resembles the group’s prior operations.

The core of the attack relied on EIP-7702, an Ethereum feature introduced in the network’s Pectra upgrade that lets a wallet temporarily delegate its behavior to a smart contract through a signed authorization. According to TRM, the attacker submitted one transaction carrying 50 pre-signed authorizations from the Binance hot wallet, each pointing to a sweeper contract the attacker controlled, exploiting the fact that a wallet’s advancing transaction count meant one of those 50 signatures was guaranteed to land on a valid nonce. Within roughly three and a half minutes of that delegation taking effect, the wallet’s full balance, including 1.615 billion USDT, was swept out.

TRM’s timeline shows Binance wallets on nine other chains, including Bitcoin, Tron, the XRP Ledger, Solana, Avalanche and Polygon, sending funds through ordinary signed transfers within about 30 minutes of the Ethereum sweep. TRM says that pattern points to a broader compromise of Binance’s hot-wallet signing infrastructure rather than a single-chain exploit, though Binance itself has not yet confirmed a specific root cause.

As of TRM’s last update, roughly $2.7 billion had been frozen across Tether, Circle, Ripple, World Liberty Financial and Arbitrum’s Security Council, while the attacker still held an estimated $2.4 billion, including more than 420,000 ETH and 18,270 BTC. The full analysis is published on TRM Labs’ own blog, which describes the incident as still developing.