TRM Estimates $6.36 Billion Transferred in Reported Binance Wallet Breach
TRM Labs estimates that roughly $6.36 billion in cryptocurrency moved from Binance-linked wallets across ten blockchains on October 29, 2026. That figure reflects the assets’ value when they moved. It is not a confirmed final loss, and neither the exact attack method nor the funds’ ultimate fate is known.
- TRM’s estimate: about $6.36 billion, based on prices when the assets moved.
- Likely weakness: TRM suspects Binance’s hot-wallet signing systems were compromised, but the root cause is unconfirmed.
- Assets restricted: TRM says about $2.7 billion had been frozen or moved beyond the attacker’s reach by 00:30 UTC on October 30.
- Attribution: TRM believes North Korea’s TraderTraitor group was responsible. This is not a legal finding.
What the $6.36 Billion Estimate Represents
In its report, “North Korean Hackers Steal $6.36 Billion in Binance Crypto Heist, ” TRM valued the assets at approximately $6.36 billion when they were transferred. Using prices at the time of its later analysis, the firm put their value at about $6.23 billion. Neither figure is an audited account of Binance’s loss, and neither shows how much will ultimately be recovered.
TRM traced activity across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. Its estimate includes about $3.79 billion in Ethereum-based assets, 18, 270 BTC valued at roughly $1.47 billion, and approximately $628 million in USDT and TRX on Tron. XRP, Solana and assets on other networks make up the rest.
Early reports gave a different Bitcoin figure. CryptoTicker said Whale Alert had flagged 16, 687 BTC across four transfers, while noting that it was unclear whether they were linked to the suspected theft or were Binance moving funds for safety. TRM’s later analysis attributes 18, 270 BTC to the incident. The discrepancy shows why early alerts shouldn’t be mistaken for a complete transaction analysis.
Blockchain records show where assets moved, but tracing them does not confirm who controlled a wallet or whether every transfer represented a customer loss. TRM’s figures are an analytics estimate, not Binance’s final accounting.
How the Ethereum Wallet Activity Unfolded
TRM says preparations began at least 36 hours before the transfers. Its analysis describes an operator wallet funded through Tornado Cash, code testing and a rehearsal before the main activity. These details are part of TRM’s reconstruction. On their own, they don’t prove who carried out the attack.
At 20:20 UTC on October 29, TRM says, the operator submitted a transaction containing 50 authorizations signed by a Binance hot wallet. The authorizations pointed to a “sweeper contract, ” code designed to move assets from a wallet. Three minutes and 24 seconds later, the first reported sweep began. TRM says it moved 167, 464 ETH and 63 tokens, including about 1.615 billion USDT.
More sweeps followed. TRM also says the hot wallet acted as an executor for a separate Binance smart account, enabling the transfer of about $823 million in USDC.
The Ethereum activity involved EIP-7702, a mechanism that lets a regular Ethereum wallet delegate certain actions to code. It requires a valid authorization. Its use does not mean Ethereum itself was compromised, and it does not explain transfers on other networks. The key question is how the authorization was obtained.
CryptoTicker’s “How the Binance Hack Unfolded: The Timeline” relayed Binance’s preliminary theory that a DevOps engineer’s laptop may have been compromised, giving an attacker access to an internal service. That remains an early reported theory, not a confirmed forensic finding. TRM separately assesses that an attacker likely gained access to Binance’s hot-wallet signing system, based on valid transfers across multiple networks.
CryptoTicker also relayed Binance’s statement that it had found no evidence of leaked wallet private keys. That doesn’t rule out abuse of the systems that request or approve signatures. An attacker could compromise the signing process without extracting the underlying key material. And the lack of evidence of a key leak doesn’t prove the signing controls stayed secure.
Frozen Funds Are Not Necessarily Recovered
Reported totals for restricted funds changed as new actions came to light. CryptoTicker reported an earlier estimate of about $2.4 billion. TRM later said Binance had verified $2.54 billion frozen at 23:35 UTC on October 29. By 00:30 UTC on October 30, TRM counted about $2.7 billion onchain. These are snapshots from different times, not one final total.
TRM’s later accounting included about 1.77 billion USDT frozen by Tether and roughly 825 million USDC frozen by Circle. Ripple froze 40.5 million RLUSD held in an attacker-linked wallet, while the Arbitrum Security Council moved 8, 426 ETH and 74.6 million ARB, valued at about $30 million, out of the attacker’s reach. World Liberty Financial froze 27.8 million USD1.
These actions work in different ways. Stablecoin issuers can restrict specific tokens at particular addresses. Arbitrum’s Security Council used a separate, governance-based intervention to move assets. Bitcoin and native ETH have no central issuer with the same power to freeze assets at an address.
And “frozen” doesn’t mean “returned.” A restriction can stop assets from moving or put them beyond an attacker’s immediate control. It doesn’t establish who is legally entitled to them or whether Binance or its customers have received them back.
TRM also describes attempts to swap assets for forms less susceptible to issuer-level freezes. It estimates that roughly 325 million USDT was sold through UniswapX and other intent-based contracts for about 122, 300 ETH, at a discount of more than 10% against the ETH market price it cited. Intent-based services let users specify a desired transaction outcome for a third party to execute. These are TRM’s transaction-analysis findings; they don’t establish that every attempted conversion succeeded.
Who Does TRM Believe Was Behind the Transfers?
TRM attributes the activity to TraderTraitor, a North Korean hacking group. The firm points to on- and off-chain intelligence, preparations made well before the transfers and similarities to previous thefts. This is an intelligence assessment, not a final legal determination or a public identification of the people involved.
TRM estimates that about $2.4 billion remained in assets beyond an issuer’s reach at the time of its analysis. That isn’t a final unrecovered-loss figure. TRM expects some funds may later move through bridges, swap services or over-the-counter brokers, based on previous thefts. That’s a forecast, not a confirmed next step.
What the Incident Shows, and What It Doesn’t
A blockchain can process transactions as designed even when an exchange’s internal systems are compromised. Network security and the security of companies using those networks are related, but they’re not the same. A valid onchain transaction doesn’t prove the exchange authorized it properly.
Public ledgers help investigators follow funds, but visibility alone doesn’t reveal who controls a wallet or guarantee recovery. Wallet balances also don’t show whether an exchange can meet all its customer liabilities. They leave out the full picture of ownership, obligations and encumbrances.
The central security question is how an attacker gained enough authority to initiate transfers across several networks. TRM’s theory about the signing system and Binance’s reported laptop hypothesis both point to possible weaknesses in internal access or authorization. Neither identifies a confirmed root cause. That answer matters more than any single headline figure because it would show which controls failed and what needs to change.
Key Questions and Answers
-
How much was transferred?
TRM estimates approximately $6.36 billion, based on prices when the assets moved. This is an analytics estimate, not a confirmed final loss.
-
Were Binance’s private keys stolen?
Binance reportedly said it had no evidence that wallet private keys were leaked. The attack method remains unconfirmed, and signing systems could have been abused without extracting key material.
-
How much was frozen?
TRM counted about $2.7 billion frozen or otherwise moved beyond the attacker’s reach by 00:30 UTC on October 30. A freeze or intervention doesn’t mean the funds have been returned.
-
Was Ethereum compromised?
TRM has presented no evidence that Ethereum itself was compromised. EIP-7702 appeared in the Ethereum wallet activity, but it’s still unknown how the required authorization was obtained.
-
Who does TRM say was responsible?
TRM attributes the activity to North Korea’s TraderTraitor group. That assessment is not a legal finding, and the people involved have not been publicly identified.
-
Have the funds been recovered?
The reported freezes and interventions don’t establish that all affected assets have been returned to Binance or its customers. Their final disposition remains unresolved.
