The $6 billion Binance hack: Inside North Korea's record crypto hack, and what compliance teams should do next

On October 29, 2026, hackers that the FBI has linked to North Korea drained Binance hot wallets across ten blockchains in just about 20 minutes. TRM Labs puts the haul at $6.36 billion, roughly four times the $1.5 billion taken from Bybit in February 2025, making it the largest crypto theft on record.

The FBI attributed the attack to North Korea’s TraderTraitor group, while Pyongyang denied any involvement. For compliance teams, the harder work starts now – billions in stolen assets are on the move, and some could reach your platform within weeks or months.

Where the money went

Ethereum took the biggest hit, at about $3.79 billion, followed by Bitcoin ($1.47 billion), Tron ($628 million), the XRP Ledger ($296 million), and Solana ($96 million), according to TRM Labs. Five smaller networks made up the remaining $77 million or so.

Stablecoin issuers can freeze their own tokens, and they did: Tether froze about $1.77 billion in USDT and Circle about $825 million in USDC. As of November 7, 2026, Elliptic reports $2.85 billion frozen or seized.

Native assets such as ETH and BTC have no issuer to freeze them. Before the freezes landed, the attackers swapped about $786 million in stablecoins into those assets, some at more than 10% below market price. As of November 7, 2026, about $3.13 billion remained in addresses linked to the attack, mostly ETH and BTC, according to Elliptic.

How the day unfolded

TRM Labs found the attackers’ wallet was funded through Tornado Cash on October 28, and the attack code was tested early the next day. On October 29 (Eastern Time):

• 4:05 pm: The first transfers leave Binance wallets on the XRP Ledger.
• 4:20 pm: Bitcoin and Ethereum outflows begin.
• About 4:24 pm: Binance’s Ethereum hot wallet is emptied.
• 5:01 pm: Tether freezes 971.1 million USDT. Circle freezes 823 million USDC three minutes later.
• About 7:05 pm: A second wave drains wallets on Avalanche and Polygon.
• 8:10 pm: Binance removes the attacker’s hot wallet permissions.

Bitcoin fell about 5% on the news. Binance said it would cover the losses from its own funds, reopened withdrawals and, since November 3, replenished 98% of the stolen coins.

The playbook

Target the human

It started months before the theft, with two separate approaches to Binance’s wallet team. In June, a Wallet DevOps engineer searched online for a popular AI coding tool and installed a tampered version of Homebrew, a widely used developer tool. Binance spotted unusual activity and replaced the device, but by then the attackers knew the engineer’s role and who else worked on the company’s wallets, according to Binance’s own report.

In September, someone posing as a recruiter approached a second engineer through a job-hunting platform. After two rounds of fake interviews, the engineer downloaded a coding “assignment” onto a work computer. It contained malware that Binance’s endpoint security tools didn’t detect. On October 20, the attackers used that computer and an internal AI tool to take over the machines of two wallet engineers, including the one targeted in June. Binance co-CEO Richard Teng later told CNBC the attackers “spent months building their way in.”

Pre-sign everything

On Ethereum, the attackers held 50 pre-signed authorizations using EIP-7702, an upgrade that lets a wallet run delegated code. One matched the hot wallet’s nonce – its next transaction number – and turned the wallet into a sweeper under the attackers’ control. Binance co-CEO Richard Teng said the delegation “did not pass through our normal approval controls.” No private keys had to be stolen – which for years was North Korea’s standard approach.

Batch for speed

EIP-7702 also lets dozens of transfers settle in a single transaction. About three and a half minutes after the authorizations went in, the hot wallet’s entire balance was gone, including 167,464 ETH and 1.615 billion USDT. Batching wasn’t essential, though: on the other chains, the attackers used ordinary transfers.

“This wasn’t one mistake. It was months of patient work against the people who run the wallets, and a response that couldn’t move as fast as the attack.”

Iain Armstrong, Executive Director of Financial Crime Compliance (FCC) Strategy, ComplyAdvantage

A decade of escalation

Before 2016, North Korea’s foreign income came mainly from coal, minerals, and workers sent abroad. Since then, its hackers have moved from banks to crypto: $81 million from Bangladesh Bank in 2016, $1.5 billion from Bybit in 2025, and now Binance. TRM Labs counts about $12.8 billion in crypto stolen by North Korea since 2017, $7.4 billion of it in 2026.

How North Korea launders stolen crypto

The laundering appears to be automated. By November 7, Elliptic had counted more than 20,000 wallets used across 16 blockchains and at least 65,000 transactions, about one new wallet every 30 seconds. Funds have passed through cross-chain bridges, THORChain, decentralized exchanges, lending protocols, and mixing services. Very little appears to have been cashed out so far. If the Bybit pattern holds, Elliptic expects the ETH to be swapped for bitcoin in small amounts and sold through over-the-counter (OTC) brokers over several months.

If past North Korean thefts are a guide, the money will move in four stages:

• Convert: Freezable stablecoins are swapped into ETH through services such as UniswapX, Uniswap, Aave, and JustLend.
• Fragment: Bitcoin peel chains, cross-chain bridges such as THORChain, and swap services break up the trail.
• Cash out: OTC brokers tied to Chinese organized crime buy the crypto, often at a discount.
• Settle in yuan: Nearly all of North Korea’s trade runs through China, so yuan covers most of its needs.

What this means for compliance teams

• Follow the off-ramps: Most of the remaining funds will need to become fiat at some point. North Korea has historically relied on Chinese money laundering networks and OTC brokers for that step. Look for unexplained crypto-to-fiat flows, OTC counterparties with thin histories, and trade or property payments that don’t fit a customer’s profile.
• Screen the published wallets now: The FBI has published 628 addresses linked to the theft: 608 on Ethereum, 19 on Bitcoin, and one on Solana. Screen deposits and their counterparties, and keep screening. Exposure often surfaces several hops downstream, long after the story leaves the headlines.
• Your people are the attack surface: Fake recruiters, fake IT workers, and compromised messaging accounts are now a standard entry point for North Korean operators. Binance says it detected and stopped 57 North Korea-related hacking attempts in 2026 before this one got through. Insider-risk controls, device policies, and staff awareness deserve the same attention as wallet security.
• Speed decided what could be recovered: Within about four and a half hours of the first transfer, roughly $2.7 billion had been frozen, almost all of it by stablecoin issuers. Real-time monitoring only helps if alerts reach someone with the authority to act at any hour. Test those escalation paths before you need them.

“The freezes were the easy part. The next six months will show whether exchanges, banks, and payment firms can spot these funds when they come back in smaller, cleaner-looking pieces.”

Andrew Davies, Global Head of FCC Strategy, ComplyAdvantage