Binance: TRM Labs estimates the theft at $6.36 billion and attributes it to TraderTraitor

Ten blockchains in the reconstruction of the theft

TRM Labs estimates that roughly $6.36 billion in assets left wallets attributed to Binance during the October 29, 2026 attack. Its analysis, with a cutoff of 00:30 UTC on October 30, describes an operation carried out mainly over about twenty minutes starting at 20:05 UTC. It attributes the attack with high confidence to TraderTraitor, a North Korean group. This is TRM's attribution: it does not, by itself, constitute a judicial finding or an announcement by the authorities.

The calculation covers ten networks and values transfers when they occurred. TRM therefore distinguishes the amount stolen from the subsequent value of the same tokens, which changes with their prices. Ethereum accounts for the largest share of identified outflows, followed by Bitcoin and Tron. This method explains why early estimates published during the incident could differ. Adding successive estimates would artificially inflate the total: they generally describe different scopes and timestamps for the same theft.

An Ethereum delegation used against a wallet

On Ethereum, the investigation describes the use of EIP-7702 to delegate a wallet's behavior to an attacker-controlled contract. The mechanism normally lets an account acquire programmable functions after signing an authorization. Here, TRM identifies fifty authorizations prepared for consecutive transaction counters. A single authorization matching the actual counter was enough to install the malicious program. The analysis therefore concerns valid signatures obtained by the attacker, without demonstrating a breakdown of Ethereum's consensus.

On other networks, the observed outflows involved ordinary signed transfers. TRM says their coordination suggests a compromise of Binance's operational-wallet signing infrastructure. An operational wallet handles functions such as withdrawals and is more directly connected to an exchange's systems than an offline reserve. The investigation still needs to establish how the authorizations were obtained and which controls failed. Reading transactions alone cannot reconstruct every instance of internal access at an exchange.

Freezing assets does not amount to reimbursement

TRM reports that about $2.7 billion was immobilized by stablecoin issuers and Arbitrum's Security Council. A freeze restricts movement of certain assets; it does not mean Binance possesses them again or customers have already received reimbursement. According to the analysis, bitcoin and ether remain under the attacker's control. Not every digital asset has the same interruption mechanism or an actor able to intervene.

The report also describes swaps and borrowing intended to transform assets before they could be immobilized. Such movements complicate tracking without automatically erasing public traces. The next useful accounting will need to reconcile stolen, frozen, returned, and potentially reimbursed funds, with a date for each figure. At this stage, TRM's analysis provides a technical reconstruction and a reasoned attribution; it does not establish full recovery or a certain date for a return to normal operations.