Binance Hack: Trace Largest Hack Ever ($6.3B) On-Chain

‍

Click here for Arkham’s Binance Hacker entity profile.

Binance has suffered the largest crypto hack in history. On October 29, an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, most of it in around 20 minutes from 20:05 UTC.

You can interact with the stolen funds with the hacker’s Arkham entity profile in the window below:

How It Happened

Binance said a compromised laptop belonging to a DevOps engineer gave the attacker access to an internal service, allowing them to submit unauthorized withdrawals. The attack has been linked to North Korea’s TraderTraitor group (aka Lazarus Group - read our guide to Lazarus here), with evidence pointing to a compromise of Binance’s hot wallet signing infrastructure.

The attacker’s operator wallet was funded through Tornado Cash starting on the morning of October 28. Early on October 29, it tested attack code on two wallets, then rehearsed the final version on a third.

Tornado Cash-funded operator wallet: 0x7C8601d4645b93cea45F71e118A729332e6B5CA0

At 20:20:59 UTC, the attacker sent an EIP-7702 transaction with 50 authorizations to Binance 14, sweeping the wallet 3 minutes 24 seconds later. That single Ethereum transaction took 64 tokens worth $2.53 billion.

$2.7B Frozen

Stablecoin issuers moved fast. Tether blacklisted the attacker’s USDT at 21:01 UTC, and Circle froze USDC three minutes later. Around $2.7 billion has now been frozen, but the attacker still holds roughly $2.4 billion.

That includes 18,270.2 BTC split into 1,000 BTC lots across 19 addresses, unmoved since 20:48 UTC. The attacker has also swapped $911 million of stolen assets into ETH and TRX.

Record Breaker

The theft is more than four times the size of the $1.5 billion Bybit hack in 2025, also carried out by North Korean hackers. Binance has suspended deposits and withdrawals and said it will cover all losses.

This is a developing story. Follow @arkham on X for live updates.