The Binance hack: $6.3 billion gone, North Korea blamed and what AML teams do next

The Binance hack on 29 October 2026 moved about 6.3 billion dollars out of the exchange's wallets, the largest crypto theft on record by TRM Labs' count. As of 30 October, Binance says about 3 billion dollars is frozen and it will cover all losses. TRM attributes the attack to North Korea's TraderTraitor unit; no government has confirmed that yet.

• Binance puts the impact at around 6.3 billion dollars, with about 3 billion dollars frozen on-chain, and says it will cover all losses from its SAFU (Secure Asset Fund for Users) emergency fund and company funds.
• Binance's initial investigation points to a compromised DevOps engineer's laptop that gave an attacker access to a service container used to submit withdrawals.
• TRM counts about 6.36 billion dollars moved across ten blockchains, most of it in about 20 minutes from 20:05 UTC, and says the attacker still holds about 2.4 billion dollars beyond any issuer's reach.
• TRM attributes the Binance hack to TraderTraitor with high confidence. The FBI used the same name for the group behind the 1.5 billion dollar Bybit theft in 2025.
• OFAC has listed Lazarus Group as a blocked entity since 2019. A joint FBI, CISA and Treasury advisory says the cybersecurity industry tracks the actors behind TraderTraitor under that name, so exposure to the stolen funds is a sanctions question as well as an AML one.

What happened in the Binance hack?

On the evening of 29 October 2026, an attacker moved funds out of Binance hot wallets on what TRM counts as ten blockchains. Binance confirmed a security incident, put the impact at about 6.3 billion dollars, suspended deposits and withdrawals and promised to cover every loss. It has not named an attacker.

The Binance announcement, published late on 29 October, says the incident "may involve a compromised DevOps engineer's laptop", which gave an attacker access to a service container and let it submit unauthorised withdrawal transactions. It adds: "We have found no evidence of any wallet private key leak." Binance revoked the affected address authorisation and called in law enforcement and blockchain intelligence partners.

Sources: Binance's 29 October announcement and the TRM report. Figures as of 30 October 2026. TRM values each transfer at the moment it was taken, which likely explains the gap with Binance's round figure.

How did the attacker drain the wallets?

TRM's reading of the Binance hack is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing, across chains with different keys and signing schemes. That fits Binance's statement that no private key leaked. The signing system was turned against the exchange rather than the keys being copied.

On Ethereum, TRM says the operator submitted a transaction at 20:20 UTC carrying 50 pre-signed authorisations under EIP-7702, which lets an account delegate execution to contract code. TRM's explanation is that a busy hot wallet's transaction count keeps moving, so preparing 50 consecutive signatures made sure one would match. Three minutes and 24 seconds later, a single transaction moved 167,464 ETH and 1.615 billion USDT.

On the other nine chains, Binance wallets sent funds through ordinary signed transfers in the same half hour, with a second wave on Avalanche and Polygon at about 23:05 UTC. TRM says staging began well before the theft, with small Tornado Cash withdrawals funding the operator wallet. The laundering so far relies on large swaps through market makers and lending protocols, including borrowing ETH against USDT on Aave, rather than the bridge-heavy pattern seen after Bybit.

For any custodian, the Binance hack raises control questions rather than conclusions about Binance. Can one service container obtain signatures without a second, independent approval? Are there velocity caps per hot wallet that would stop a full balance sweep in minutes? Does monitoring flag a batch of pre-signed authorisations or a delegation to unverified contract code before it executes?

What obligations does the Binance hack trigger?

The Binance hack creates duties for firms that never touched Binance. Exchanges, custodians, payment firms and banks with crypto exposure must screen for the stolen funds, decide whether a North Korean link makes them blocked property, file suspicious activity reports where required and review the insider access controls that this attack exploited.

Sanctions screening. OFAC designated Lazarus Group in September 2019 as an agency, instrumentality or controlled entity of the North Korean government under E.O. 13722. A joint FBI, CISA and Treasury advisory on TraderTraitor says the group is "commonly tracked by the cybersecurity industry as Lazarus Group, APT38, BlueNoroff". The duty to block turns on whether a blocked person has an interest in the property, not on a public attribution. Where it applies, US persons must block the property and, under 31 CFR 501.603, report it to OFAC within 10 business days. OFAC enforces on a strict liability basis, so waiting for an official attribution is not a safe harbour.

No attacker addresses from this incident are on the SDN List yet, so screening has to rely on analytics labels and published indicators. Sanctions screening needs both layers: wallet screening for the stolen funds, and name screening for the people and front companies OFAC lists, such as the IT worker handlers designated on 28 October 2026.

Blocking requests. After Bybit, the FBI's public service announcement asked exchanges, bridges, analytics firms and other virtual asset service providers to "block transactions with or derived from addresses TraderTraitor actors are using". It published 51 Ethereum addresses. A similar list for this incident would turn analyst labels into a named government request.

Suspicious activity reporting. A deposit that traces back to the attacker's addresses is the textbook case for a Suspicious Activity Report in the United States or a suspicious transaction report elsewhere. Exposure can arrive indirectly, through swaps with market makers and loans on lending protocols, so transaction monitoring needs hop-based tracing rather than direct-exposure rules only.

UK reporting. In the UK, a regulated-sector employee who knows or suspects, or has reasonable grounds for knowing or suspecting, money laundering from information received in the course of regulated business, and does not disclose it as soon as practicable, commits an offence under section 330 of the Proceeds of Crime Act 2002. A firm that wants to deal with suspected proceeds, for example to return or release them, needs an authorised disclosure and appropriate consent first, the route usually called a defence against money laundering request.

Insider and hiring controls. Binance's initial finding on the Binance hack points to an engineer's device. In the DMM Bitcoin case, the FBI found TraderTraitor posed as a LinkedIn recruiter and sent a "pre-employment test" that compromised an employee with wallet access. Treat staff with signing access as high-risk identities, and recheck them during employment, not only at hire.

What is still uncertain, and where are the risks?

The biggest open question in the Binance hack is the root cause. Binance calls its view initial and has promised a technical post-mortem, while TRM's on-chain evidence points to signing infrastructure across ten chains. Attribution, the final loss figure, how much more can be frozen and how regulators respond are all still moving.

Attribution is private, not official. TRM's judgment is high confidence, but no government agency had published an attribution when this article was written. In the Bybit case the FBI named TraderTraitor five days after the theft. Until a government does, a firm's view that Binance hack proceeds are blocked property rests on analytics labels, so record why you acted.

The numbers do not yet add up. Binance says about 3 billion dollars is frozen; TRM counts about 2.7 billion dollars. TRM puts the stolen assets' current value at about 6.23 billion dollars. Its frozen and retained figures cover about 5.1 billion dollars of that, so by our arithmetic about 1.1 billion dollars is not broken down. The swaps and loans described below may account for part of it. In a filing, cite both sources and say which figure you rely on.

A race against freezes. TRM says the attacker sold USDT to market makers and borrowed ETH on Aave to get ahead of issuer freezes. Every counterparty that received assets from the theft may now hold tainted funds without having dealt with the attacker directly, which widens exposure well beyond exchanges.

Customer cover is a promise, not a guarantee. Binance says user funds are safe and that its SAFU fund and company funds will cover losses. It also says it will publish an updated Proof of Reserves after remediation. Until then, firms with balances at Binance should treat the pledge as a counterparty risk item.

Regulatory follow-up. Binance withdrew its Greek MiCA licence bid on 24 June 2026, as covered in our report on Binance and MiCA, so no EU supervisor authorises it under MiCA. No regulator had commented on the hack when this was written.

How does the Binance hack compare with earlier North Korea-linked thefts?

The Binance hack is about four times the size of Bybit, the previous record, and follows a pattern the FBI has documented for years: target the people and systems that sign transactions, not the cryptography. Each earlier case took days or months to reach a government attribution. This one is still at the analyst stage.

Sources: the FBI Ronin statement, the FBI DMM release, the FBI Bybit announcement and the TRM report.

The common thread is people. DMM began with a fake recruiter, and on 28 October 2026 OFAC sanctioned the handlers of North Korean IT workers who use stolen identities to get hired, as covered in our report on DPRK IT worker sanctions. Identity at the point of hiring is now part of crypto security.

How should compliance teams respond?

Compliance teams should act now on exposure to the stolen funds and record their reasoning, because the facts will shift. Screen inbound and historical flows against the attacker's addresses, decide how to treat assets that passed through intermediaries, prepare reports and review who in your own firm can trigger a withdrawal.

First, load the addresses your analytics provider has labelled for the Binance hack into wallet screening, and run a look-back from 29 October, not only a forward screen. Second, set a written position on indirect exposure through market makers and lending protocols, and escalate any match for sanctions review. Third, prepare SAR or STR narratives that cite the Binance announcement and the attribution source.

Fourth, map every employee and contractor with signing or withdrawal authority, confirm their identity again and treat unsolicited recruiter contact and coding tests as a reportable security event. Fifth, watch for an FBI or Treasury attribution and update your decisions when it lands.

Zyphe helps with the identity side of that list. Its KYC software verifies identities with NFC chip reads of ePassports and eID cards and active liveness, gives you an exportable audit trail and keeps no central store of customer PII. To see how it fits a crypto onboarding flow, book a demo.

The bottom line

The Binance hack shows that the weakest point in crypto custody is often a person with signing access, not the cryptography. For AML teams the immediate work is exposure screening, sanctions escalation and reporting, done with a clear record of why each decision was made. For security and HR teams it is a reminder that hiring and staff identity checks protect the treasury as much as the onboarding flow does.

Cited sources

• Binance, Security Incident Update, 29 October 2026
• TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
• FBI, North Korea Responsible for $1.5 Billion Bybit Hack, PSA I-022625-PSA
• US Treasury, Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups, 13 September 2019
• FBI, DC3 and NPA identification of TraderTraitor in the DMM Bitcoin theft, 23 December 2024
• FBI, CISA and Treasury, TraderTraitor advisory AA22-108A
• 31 CFR 501.603, reports of blocked property, eCFR
• Proceeds of Crime Act 2002, section 330, legislation.gov.uk
• Proceeds of Crime Act 2002, section 338, legislation.gov.uk
• FBI, Statement on attribution of the Ronin theft, 14 April 2022