TRM Says Binance Attacker Still Holds About $2.4 Billion Out of Issuers' Reach as Exchange Cites Multiple 'Points of Breach'

Since Binance confirmed a suspected security incident on the evening of Oct. 29, the story has moved from "how big" to "how did they do it" and "how much can be clawed back." The latest detail comes from TRM Labs, which published a technical breakdown, and from Binance itself, which now says its first explanation was incomplete.

The mechanics, per TRM

TRM says the attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. A second wave around 23:05 UTC hit Binance wallets on Avalanche and Polygon.

On Ethereum, TRM says the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper under the attacker's control. Fifty pre-signed authorizations had been prepared in advance.

On the other nine chains, TRM says Binance wallets sent funds to the attacker through ordinary signed transfers. In TRM's assessment, that pattern points to a compromise of Binance's hot wallet signing infrastructure, not a flaw in any single blockchain.

TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, and says it makes that judgment "with high confidence." It cites small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance and executed in one burst. TRM says those features match the February 2025 Bybit hack and the April 2026 KelpDAO hack. The FBI named TraderTraitor as responsible for Bybit's $1.5 billion loss. Chainalysis CEO Jonathan Levin has also said the Binance hack was "likely done by DPRK group TraderTraitor."

These are private-sector attributions. Binance said it is working with law enforcement partners to confirm the identity of the attackers.

What was frozen and what wasn't

TRM says Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins. Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network. TRM puts the combined freezes at roughly $2.7 billion. Binance has said it worked with partners to freeze roughly $3 billion.

The attacker did not sit still. TRM says it raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion in assets TRM describes as beyond any issuer's reach.

That is the open question for recovery. Stablecoin issuers can freeze tokens. Nobody can freeze native ETH or BTC once it sits in an attacker's wallet. TRM says it is tracking the funds and alerting partners through its Beacon Network.

Binance's account changes

Binance said Friday, Oct. 30, that deposits were unaffected, that withdrawals remain suspended, and that it expects them to resume in the next day or two. The company says it will cover all losses and that user funds are safe.

Binance had earlier said an initial investigation suggested the incident may have involved a compromised laptop. It now says a subsequent investigation found additional "points of breach." The company has not said publicly what those are.

Founder Changpeng Zhao, who left the CEO role after pleading guilty in 2023 to a felony tied to anti-money-laundering failures, posted that "User funds are safe!" He also said the theft "does look like a hack on Binance." Zhao added that he no longer manages the exchange but, as a shareholder, expects all user funds to be covered. President Trump pardoned Zhao in 2025.

North Korea's playbook

Microsoft Threat Intelligence published a separate assessment of North Korean threat actors. It rates their overall adoption of AI as high and says AI is being used to speed up and scale existing workflows, such as building lures, front companies and tooling. Microsoft says the operations remain human-directed and not fully autonomous.

Microsoft's report does not mention Binance, and nothing published so far says AI was used in this attack. What it does establish is the baseline: Microsoft says North Korean tradecraft remains grounded in social engineering, malware delivery and abuse of legitimate tools, and that cryptocurrency and financial organizations are common targets. It says the regime's cyber operations are aimed primarily at generating revenue under international sanctions.

The scale fits that pattern. South Korea's spy agency estimated in December 2022 that North Korean hackers had stolen about $1.1 billion in crypto over the prior five years. The Binance theft, at TRM's figure, is roughly six times that.

What comes next

The immediate test is whether Binance resumes withdrawals within its stated one-to-two-day window and whether it discloses the additional breach points. The second is the $2.4 billion in unfrozen ETH and BTC: how fast it moves through mixers and cross-chain bridges will determine how much is ever recovered. Binance has not said how it will fund the coverage of losses if the frozen assets are not released.