Inside the $6.4bn Binance theft: what failed and how crypto is traced

The FinCrime Wire · Research and analysis · By the FinCrime Wire Reporting Desk
Sources checked 3 November 2026 · 14 minute read · Long read

A blockchain can faithfully record a theft. Understanding that apparent contradiction is the key to understanding crypto security, and to tracing what was taken.

Binance’s security incident on 29 October raises a question that reaches beyond one exchange. If crypto transactions are secured by cryptography and recorded on a public ledger, how can billions be stolen? And why can investigators often see the money without being able to recover it?

The answer lies in separating three things: the network that records transactions, the systems that authorise them, and the institutions that can identify people and enforce ownership.

The evidence reviewed here points to compromised transaction authority. It does not suggest that attackers defeated Bitcoin’s underlying cryptography.

What happened

The theft. TRM Labs estimated that about $6.36bn left Binance wallets across ten blockchains, valuing each transfer at the asset’s price when it was taken [1]. At later prices the same assets were worth about $6.23bn. TRM’s reconstruction included 18,270 BTC, worth about $1.47bn. The outflow began at 20:05 UTC on 29 October and most funds left within about 20 minutes. These are TRM’s figures as at 00:30 UTC on 30 October. Chainalysis put the total at about $6.4bn [2].

Frozen funds. Chainalysis reported that about $2.8bn had been frozen, with freezes under way by 5:14 p.m. ET on 29 October [2]. Chainalysis did not say when that total was measured; its page was last updated on 30 October.

Attribution. TRM and Chainalysis both attributed the theft to TraderTraitor, a North Korean hacking unit [1][2]. On 31 October the FBI said North Korea was responsible for the theft of more than $6bn from Binance on or about 29 October, and named the activity TraderTraitor [3]. It said stolen assets were being converted primarily into ether and were expected to be laundered further through DeFi and instant swap services. The FBI, the US Secret Service and IRS-CI published several hundred Ethereum addresses, 19 Bitcoin addresses and one Solana address that hold or have held stolen assets. They asked node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from them [3]. North Korea rejected the attribution. In a statement published by North Korean state media, Kim Yo Jong called the FBI’s claims “absurd rhetoric and nothing new” [4].

Binance’s response. Binance said it had covered about 95% of the affected amount using its own funds, and was still acquiring less liquid tokens outside the top ten [5]. That is replenishment by the exchange, not recovery of stolen assets. Binance also said it will bear the financial impact and will not pass losses to users [6]. On 3 November it began reopening withdrawals for more assets from 04:00 UTC, progressively and after checks on each asset and network; not all assets would be available at once [6].

No independently verified account of the initial intrusion, or of every failed internal control, had been published by the time of writing. Binance had not published a root cause [1].

What a crypto wallet actually controls

A wallet does not hold coins the way a purse holds banknotes. It manages the credentials and interfaces used to control assets recorded on a network.

Bitcoin’s ledger tracks unspent transaction outputs (UTXOs). Each has a value and conditions that must be met to spend it. In a simplified payment:

• A user controls an unspent output worth 1 BTC.
• A transaction consumes it, creating 0.2 BTC for the recipient and 0.7999 BTC in change.
• The remaining 0.0001 BTC is the fee.

Spending usually requires valid digital signatures. The private key itself is never broadcast [7].

Ethereum uses accounts with balances, and smart contracts that run programmed rules. An ordinary externally owned account is controlled by a private key; a contract’s behaviour is governed by its code. Tokens keep their own balance records inside contracts [8].

This is why losing a phone need not destroy crypto if recovery credentials stay safe. It is also why exposed credentials can drain assets while the device never leaves its owner’s hands.

Exchange balances, issuance and price

Bitcoin is created by miners under consensus rules, with a block subsidy that falls over time towards a cap of just under 21 million coins. Opening a wallet creates no bitcoin. Other tokens differ: a contract may let an authorised party mint units, and that power needs examining separately from the chain hosting the token.

On a centralised exchange, a trade usually updates the exchange’s internal ledger without any blockchain transaction. A withdrawal creates the external settlement. An exchange balance and direct on-chain control are therefore different exposures.

Price comes from buyers and sellers, not from the protocol. Scarcity limits supply; it does not guarantee demand [9].

A theft therefore has three distinct numbers: the quantity stolen, its value when taken, and what the thief can actually realise. TRM’s two valuations, $6.36bn at the time of transfer and about $6.23bn at later prices, show how fast the second number moves [1]. Freezes, trading losses and thin liquidity shrink the third.

How a blockchain can approve a theft

Bitcoin nodes check every transaction and block against consensus rules. Blocks link to earlier blocks through cryptographic hashes, and proof of work makes rewriting history ever more costly [10].

These protections stop invalid spending and competing histories. They do not establish whether the person causing a transaction to be signed was entitled to do so, or understood what they signed.

A transaction can be valid under network rules and still unauthorised by the lawful owner.

An attacker might steal a private key. Or the attacker might manipulate a legitimate signing service, or trick someone into approving a harmful transaction. In those cases the key may never leave its protected device.

The network sees only the resulting signature. It cannot see an employee’s intended instruction, an altered approval screen or an internal policy that should have stopped the payment. A secure ledger cannot make up for failures in the systems that instruct it.

What the Binance evidence says about the weak point

On Ethereum, the attacker did not simply send a payment. TRM reported that the attacker used an EIP-7702 delegation to make a Binance Ethereum hot wallet run a sweeper contract that took instructions only from the attacker’s operator [1]. The attacker had prepared 50 pre-signed authorisations covering 50 consecutive transaction counts, so that one would be valid when used. The delegation stayed in place, and the attacker swept new deposits from the wallet repeatedly afterwards. Chainalysis reported that the operator wallet submitting the authorisations had been funded through Tornado Cash [2].

On the other nine chains, transfers were ordinary signed transactions made in the same window [1]. TRM said Ethereum activity alone could be explained by phished authorisations, but the cross-chain pattern points to a compromise of Binance’s hot-wallet signing infrastructure. Its assessment is that the attacker most likely gained the ability to make Binance’s signing system sign transactions of its choosing. That is an assessment, not a confirmed finding: it does not establish whether keys were extracted or a signing workflow was manipulated.

Why EIP-7702 matters

EIP-7702 lets an ordinary Ethereum account authorise code to run on its behalf. Legitimate uses include batching transactions and more flexible wallets.

The security consequence is large. A single authorisation can change how an account behaves until it is changed or cleared, far beyond a one-off payment. The specification warns that a poorly built delegate can give a malicious actor near-complete control of the account, and calls changing a delegation “a security-critical operation” [11]. The Binance case shows the risk in practice: one authorisation kept working after the main theft ended.

For investigators, the questions are broader than who obtained a password:

• What exactly did the signing system approve?
• Did the approval screen show the real consequences?
• Could a signer tell a payment from a change in account authority?
• Were independent checks applied to the actual signed data?
• Could one compromised service act on wallets across several chains?

These are questions for the incident investigation, not findings.

Where crypto systems can fail

This is a general threat model, not a list of confirmed causes of this incident.

Each layer needs a different remedy. A smart-contract audit says nothing about an exchange’s staff devices. A hardware wallet cannot guarantee that a person understands what they are approving. Even a majority-hashpower attack on Bitcoin concerns ordering, censorship and double-spending; it does not hand over the private keys needed to spend other people’s coins.

What happens after the assets are stolen

The first aim is to move assets beyond the victim’s reach. Later steps try to avoid freezes, blur attribution and turn proceeds into usable value.

Chainalysis reported that the attacker swapped $325m in stablecoins for $285m in ETH over nearly 20 minutes, taking about $40m less than it gave up [2]. Ten minutes later, the remaining $175m in stablecoins went to stopover wallets. Chainalysis also described thousands of transactions in a short period, with funds cycled between addresses in a way that suggests automation. It said stolen funds were seen mixing with proceeds of the earlier Bitget theft, which had already been attributed to North Korea.

The economics are telling. Stablecoin issuers can freeze tokens; native ETH has no issuer. A thief may prefer a smaller sum that stays movable to a larger one that can be immobilised.

Beyond this case, investigators commonly look at five pathways. These are general patterns, not findings in the Binance case.

• Splitting and recombining. Many addresses add workload but do not erase the record.
• Swapping assets. A swap changes what is held, but on a transparent chain its execution may still link input to output.
• Crossing networks. A bridge, exchange or swap service adds an evidential boundary. Matching amounts alone do not prove a link.
• Entering custodial services. Inside an exchange, transfers between customers move onto a private ledger.
• Conversion. Proceeds may fund purchases, pass through intermediaries or become cash. Proving that needs evidence beyond an address.

Why visible money can still be hard to find

“Finding the money” can mean four different things.

Public blockchains expose addresses, amounts and links between transactions. They do not attach verified identities.

Analysts infer common control from patterns. Bitcoin inputs spent together may suggest one owner, but collaborative transactions break that inference. Research on cross-ledger tracing notes that CoinJoin is designed to defeat this heuristic [12]. A cluster is an analytical conclusion that needs testing, not an identity document.

Further limits arise when funds enter private exchange ledgers, privacy tools or services whose records are unavailable. Reaching customer records may need legal process across borders. Where clean and illicit funds share infrastructure, investigators must explain their tracing method. Exposure to a flagged address does not prove that every downstream recipient knowingly took part.

The right conclusion is neither “crypto is anonymous” nor “everything is traceable”. Visibility varies, and visibility alone settles neither identity nor ownership.

How stolen crypto is actually recovered

Recovery needs a mechanism that changes who controls the assets. Some issuers can freeze centrally administered tokens under their contract controls. A custodial exchange can restrict an account. Investigators may obtain keys through lawful searches. Assets may be surrendered under a legal settlement.

Native bitcoin has no issuer blacklist and no chargeback. Seeing an address does not let an investigator spend from it, and a court order does not produce a signature.

The Bitfinex case shows the missing link. In February 2022, the US Department of Justice announced the seizure of more than 94,000 BTC linked to the 2016 Bitfinex hack [13]. Agents found files containing the private keys through court-authorised searches of online accounts, and used those keys to seize the funds. The transaction trail alone could not do that.

Four terms should stay separate in coverage of this case:

• Traced: relevant movements or holdings have been identified.
• Frozen: movement has been restricted, as with the $2.8bn Chainalysis reported [2].
• Seized or recovered: assets are under lawful control.
• Replenished: replacement assets cover a shortfall, as with Binance’s 95% [5].

Even seizure does not mean immediate restitution. Ownership claims and legal proceedings may follow.

Proof of reserves answers a different question

On 2 November Binance said it had generated a zero-knowledge proof for its reserves snapshot of 31 October, 00:00 UTC. The proof covers ten tokens: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC [5]. That is a company statement about its own framework.

Such proofs are useful within their scope. But proving a balance over submitted data cannot show that every liability was included, or that the business has no other obligations. A staff advisory from the PCAOB’s Office of the Investor Advocate (8 March 2023) said proof-of-reserves reports are not audits. It said they likely do not address liabilities and give no assurance on internal controls or governance [14].

Three questions need separate evidence: Are customer obligations backed? Has the intrusion been contained? Have stolen assets been recovered? A reserves proof cannot answer all three.

What security and custody teams should change

LearnAML’s view is that custody reviews should examine the whole path from a business instruction to a signed transaction.

• Make approval meaningful. Reviewers need to see the destination, asset, amount, network, contract action and any continuing authority being granted. A familiar address or a successful login is not enough.
• Test whether controls are really independent. Multisignature and multiparty computation spread signing power. That protection weakens if every signer relies on the same compromised interface, administrator or transaction builder.
• Cap what one failure can lose. Hot-wallet balances, transfer limits, independent destination checks and separated custody functions limit the loss before anyone intervenes.
• Treat delegations and permissions as live exposure. The Binance delegation kept sweeping deposits after the main theft [1]. Incident response must review outstanding authorisations, not only passwords and devices.
• Prepare evidence in advance. Keep transaction IDs, networks, token contracts, timestamps, approval records, signing logs and the valuation method, with provenance another investigator can reproduce.
• Measure intervention speed. Rehearse routes to custodians, issuers, investigators and legal decision-makers.

These are priorities drawn from the system’s trust relationships, not claims about which controls Binance had.

What to follow next

1. The root cause. What gave the attacker signing authority, and what evidence shows the first intrusion?
2. A reconciled asset account. How much is movable, frozen, seized, replenished or returned, without double-counting?
3. Evidence of remediation. What independent evidence supports the safety of restored custody and withdrawals?
4. The conversion trail. Which services received proceeds, and what links on-chain movements to identifiable people?

The deepest lesson is about the limits of cryptographic authorisation. A blockchain can verify that spending conditions were met. It cannot verify that a person understood them, that internal approvals were legitimate, or that the recipient was entitled to the assets. Financial-crime work connects those worlds: transaction evidence, identity, institutional controls and lawful recovery.

Learn more on LearnAML

• Cryptoassets & Financial Crime
• Crypto Forensic Lab (free practice)
• Sanctions Compliance in Practice
• AML Investigations & STR/SAR Reporting in Practice
• CDD & EDD in Practice

Sources

1. TRM Labs, North Korea steals USD 6.36 billion from Binance in the largest hack in history, 29 October 2026 (figures as at 00:30 UTC, 30 October).
2. Chainalysis, Binance exploit: latest findings and response, 30 October 2026 (page last updated 30 October).
3. FBI, North Korea Responsible for $6 Billion+ Binance Attack, 31 October 2026.
4. ABC News (news report), North Korea dismisses Binance heist allegations as 'absurd' US rhetoric, 3 November 2026.
5. Binance, Recovery Update #5: October 31st PoR snapshot now fully verifiable by users, 2 November 2026.
6. Binance, Recovery Update #6: Withdrawals reopen for more assets, 3 November 2026.
7. Bitcoin Developer Documentation, Transactions.
8. ethereum.org, Ethereum accounts.
9. bitcoin.org, Frequently asked questions.
10. Bitcoin Developer Documentation, Block chain.
11. Ethereum Improvement Proposals, EIP-7702: Set code for EOAs.
12. Yousaf, Kappos and Meiklejohn, Tracing Transactions Across Cryptocurrency Ledgers, USENIX Security Symposium, 2019.
13. US Department of Justice, Two arrested for alleged conspiracy to launder $4.5 billion in stolen cryptocurrency, 8 February 2022.
14. PCAOB Office of the Investor Advocate, Exercise caution with third-party verification (proof of reserve) reports, 8 March 2023.

Research note: this article draws on official statements, published investigator findings, protocol documentation and academic research. LearnAML has not reconstructed every transaction or examined Binance’s systems. Incident findings are attributed to their sources; technical explanations and recommendations are LearnAML’s analysis.

Compiled from official and public sources by the FinCrime Wire Reporting Desk. This article is general information, not legal advice. Last updated 3 November 2026.