SOC, XDR, and Threat Intelligence

Largest crypto heist in history: ~$6.4 billion from Binance, FBI and Chainalysis point to North Korea

On October 29, 2026, funds began to be exfiltrated from Binance’s hot wallets – a total of approximately $6.4 billion USD across multiple chains, which Chainalysis calls the largest cryptocurrency heist in history. Attribution points to the North Korean group TraderTraitor.

  • SourceChainalysis
  • Source PublicationOctober 30, 2026
  • TypeThreats and Incidents

What happened

According to Chainalysis (Oct 30), funds began to flow out around 4:20 PM ET on October 29. On Ethereum, the attacker used an operational wallet funded by Tornado Cash to submit valid, signed authorizations that allowed Binance’s hot wallet to execute the attacker-deployed code – and then swept the assets. Chainalysis based the attribution to North Korea on on-chain evidence: the commingling of stolen funds with loot from an earlier Bitget theft. The FBI, according to reports from November 3, also points to TraderTraitor; North Korea denies it.

The laundering bears traces of automation – thousands of transactions, addresses first receiving exactly 1 TRX, then funds being transferred further. By November 3, approximately $2.8 billion USD had been frozen.

Key findings

  • Amount: approximately $6.4 billion USD (various estimates 6.3–6.36 billion); date: October 29, 2026; attribution: TraderTraitor / North Korea (Chainalysis on-chain, FBI).
  • Vector on Ethereum: signed authorizations from an operational wallet funded by Tornado Cash allowed attacker code to be executed in the hot wallet.
  • Industry Response: approximately $2.8 billion USD frozen by November 3; cooperation among stablecoin issuers, law enforcement, and analytics firms.
  • UNCERTAIN: a separate report (Vectra via Cyware) describes the entry vector as social engineering – a fake job interview, malicious binary, and an internal AI tool for lateral movement. Chainalysis does not confirm this; we treat it as unverified.

Why it matters

SafeWave CommentaryFor financial institutions, which are SafeWave’s core clients, the scale is not the most important factor, but rather two mechanisms. First: the abuse of valid, signed authorizations – the same pattern as the abuse of tokens and OAuth consents in corporate environments, where a stolen or phished authorization does exactly what it’s allowed to do and doesn’t look like a breach. Second: if the social engineering thread with a fake recruitment (typical for DPRK groups) is confirmed, it’s a reminder that the entry point to even the best-secured infrastructure can be a human. Operationally: inventory and limit the scope of consents and signing keys, detect unusual authorizations, and implement strict verification procedures for remote recruitment and contractor access.