Lazarus Group Suspected in Binance Hot Wallet Theft of $6.3 Billion
Blockchain investigators have linked the October 29 theft of roughly $6 billion from Binance to North Korea's Lazarus Group, though exact figures and attribution remain contested. Binance has not confirmed the attacker's identity, and the scale would make it the largest crypto theft on record.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The Reported Scale of the Theft
Blockchain investigators put the value of the October 29 theft from Binance between $6.3 billion and $6.36 billion, depending on the source. Crypto.news reported the figure as approximately $6.3 billion, while TRM Labs traced about $6.36 billion leaving Binance-controlled wallets across ten networks, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. CoinDesk described the loss as nearly $6 billion, a rounder figure that falls within the same range.
The gap between estimates reflects how the funds were counted rather than a dispute over the core event. TRM said most of the outflows occurred in about 20 minutes beginning at 20:05 UTC, with roughly $3.79 billion moved on Ethereum, $1.47 billion on Bitcoin and $628 million on Tron. It also identified 233.46 million XRP, worth nearly $296 million, leaving five Binance wallets before the Ethereum activity began.
Attribution to Lazarus and TraderTraitor
TRM Labs attributed the attack to TraderTraitor, a North Korean hacking unit it associates with the Lazarus Group, and said it had reached that conclusion with high confidence. TRM did not publicly disclose all of the evidence behind the attribution. Blockchain investigator ZachXBT separately identified Lazarus as the likely attacker. Security researchers quoted by CoinDesk also pointed to Lazarus, while Binance has not confirmed who carried out the theft.
The FBI has previously tied TraderTraitor to the February 2025 Bybit theft, in which approximately $1.5 billion was drained from that exchange. U.S. authorities have accused North Korean hacking operations of stealing cryptocurrency to help finance the country's weapons programs. Attribution at this stage rests on private investigator analysis rather than an official government finding.
How the Wallet Was Compromised
Blockaid's technical review identified an unusual Ethereum transaction carrying 50 EIP-7702 authorizations aimed at Binance 14, one of the exchange's busiest hot wallets. EIP-7702 lets an Ethereum wallet authorize smart contract code to act on its behalf. According to Blockaid co-founder and CEO Ido Ben-Natan, the attacker prepared authorizations against 50 consecutive transaction counters, so that one would match the wallet's current counter. Only one succeeded, and it allowed a malicious contract to move assets out of the wallet.
Ben-Natan said the attacker had effectively reprogrammed the hot wallet so a single operator could drain it, including any funds deposited later. Blockaid estimated that about $2.5 billion left Binance 14, including 167,464 ETH and more than $1.6 billion in USDT. TRM said preparation began at least 36 hours before the theft, with three small Tornado Cash withdrawals used to fund an attacker-controlled wallet that tested the malicious code.
Remaining Funds and Laundering Risk
Onchain Lens reported that the attacker moved 17,260 ETH, worth roughly $38.82 million, to a new wallet, raising concern that funds could be laundered through Tornado Cash or other mixers. The same tracker said the attacker still held about 480,720 ETH, valued near $1.08 billion, which token issuers cannot freeze. Ben-Natan said Blockaid's team was continuing to trace the stolen assets, and that investigators had identified further transfers involving Bitcoin and Tron. Whether the remaining balances can be recovered has not been reported.
Why It Matters
For Traders
Continued attacker transfers and possible mixer use could keep liquidity and price action around ETH, USDT and XRP volatile while on-chain tracing continues.
For Investors
A theft of this size at the largest exchange raises questions about custody practices and counterparty risk across centralized venues.
For Builders
The EIP-7702 authorization exploit shows that delegated wallet code can be abused through nonce manipulation, so wallet and hot-wallet designs should be reviewed.
This article is for information only and is not financial advice. Read the full disclaimer.
