The $6.4 Billion Binance Hack: DPRK, Stablecoin Freezes, and What It Means for Crypto Accounting
On 29 October 2026, $6.43 billion in cryptoassets was drained from Binance, the world's largest crypto exchange, across 11 blockchains in a matter of hours. Elliptic has attributed the attack to North Korea's TraderTraitor group, linked to the Lazarus Group, making this not just the largest crypto theft on record but almost certainly the single largest known theft of any kind. For accounting firms, CFOs, and compliance professionals with exchange exposure or digital asset holdings, the event raises immediate questions around asset recoverability, stablecoin counterparty risk, and the adequacy of exchange-held custody disclosures.
Scale and Timeline of the Attack
The theft unfolded in two waves. The first began at approximately 20:05 UTC on 29 October, when five Binance wallets on the XRP Ledger sent 233 million XRP to a single attacker-controlled address. Over the following 30 minutes, hot wallets on Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum, and Avalanche were also drained. A second wave struck wallets on Avalanche and Polygon shortly after 23:00 UTC.
Breakdown by chain and asset
Ethereum accounted for the largest share of losses. The attacker took $3.80 billion across 186 different tokens on that chain alone, including 1.9 billion USDT and 823 million USDC. A single transaction at 20:24 UTC moved $2.53 billion, two-thirds of the Ethereum total. On Bitcoin, 18,270 BTC worth approximately $1.48 billion was stolen. Tron contributed a further 612.7 million USDT to the total. Four assets, USDT on Ethereum, BTC, USDC, and USDT on Tron, accounted for 74% of the theft by value.
Elliptic's figure of $6.43 billion excludes a further $169 million that left Binance after withdrawals were suspended. On-chain analysis suggests this represented Binance moving its own funds rather than attacker activity, as the destination addresses were long-established and unconnected to the theft.
How the Attack Was Executed
Binance's initial investigation points to a compromised DevOps engineer's laptop as the entry point. The exchange says no private keys were leaked. Instead, the attacker appears to have manipulated Binance's own signing infrastructure to authorise transactions on their behalf.
EIP-7702 exploitation on Ethereum
On Ethereum, the attacker exploited EIP-7702, a feature introduced in the 2025 Pectra upgrade that allows a regular wallet to delegate its behaviour to a smart contract. The attacker submitted 50 pre-signed authorisations, each covering a different nonce, ensuring at least one would be valid at execution time. This delegated control of a Binance hot wallet to a "sweeper" contract, which then emptied the wallet of 167,464 ETH and 1.6 billion USDT. Critically, the delegation remained in place after the initial drain, allowing the attacker to sweep new deposits into the same wallet at least six more times over the following three and a half hours.
Preparation and rehearsal
Elliptic's analysis shows the attack was methodically prepared. On 28 October, an attacker-controlled wallet received small withdrawals from the Tornado Cash mixer. The following day, the attack code was tested on two wallets and rehearsed on a third, roughly four hours before deployment against Binance. A second Binance hot wallet on Ethereum also signed nine transfers worth $174 million directly to the attacker, suggesting the attacker had direct reach into the exchange's signing infrastructure rather than simply manipulating a single wallet's permissions.
The pattern closely mirrors the February 2025 Bybit theft, in which North Korean hackers compromised a developer's machine at wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved. In both cases, the cryptographic keys themselves were not stolen. The attack surface was the human and infrastructure layer surrounding them.
Stablecoin Freezes: What Was Recovered and What Was Not
Stablecoins represented $3.46 billion of the stolen total, and the attacker was slow to convert them, which created a short window for issuers to act. Tether froze the attacker's main Ethereum wallet 37 minutes after the stolen USDT arrived, locking 1.18 billion USDT in place. Within 17 minutes of that action, Tether had followed the funds and frozen four further attacker addresses. Circle froze the 823 million USDC in the same wallet three minutes after Tether's initial action. Ripple, World Liberty Financial, Paxos, and First Digital froze further stablecoins. Tether also froze tokenised gold held by the attacker. Binance froze the WBETH it issues, and the Arbitrum Security Council took emergency action to move assets out of the attacker's reach.
Verified frozen amounts by chain
Elliptic has verified $2.84 billion of frozen funds on-chain, close to Binance's own estimate of around $3 billion. Stablecoins account for 94% of the frozen total, concentrated almost entirely on Ethereum and Tron. Arbitrum is the only chain where nearly all stolen assets have been secured. Nothing stolen on Bitcoin, the XRP Ledger, Solana, or NEAR has been frozen, because native assets on those chains have no issuer with freeze authority. Ripple, for example, can freeze RLUSD but not XRP. Aave froze its markets in response, but this restricted new activity rather than seizing any of the attacker's existing positions. Elliptic's analysis also identifies an Aave position holding $59.9 million in collateral against $44.4 million in debt, which sits outside the verified frozen total.
Laundering activity already underway
Before the issuer freezes took effect, the attacker had already converted approximately $786 million of stablecoins into ETH and TRX. Subsequent on-chain activity shows a further 434 million USDT swapped for approximately 160,451 ETH through Uniswap, 1inch, and request-for-quote market makers. The conversion strategy is consistent with North Korean laundering tradecraft: move stablecoins to native assets that no central party can freeze, then layer through decentralised protocols.
Attribution to DPRK and Wider Context
Elliptic attributes the theft to DPRK based on on-chain evidence, including the confirmed flow of some stolen funds to addresses previously linked to a suspected DPRK exploit of Bitget. The attack methodology aligns with TraderTraitor, a hacking group associated with the Lazarus Group and tracked by US authorities. The US government has publicly linked DPRK crypto thefts to the funding of the regime's weapons programs. If the attribution holds, this single incident would nearly double the total cryptoassets the regime is believed to have stolen across recent years.
For context on the broader DPRK threat to the industry, the US Treasury and OFAC have previously sanctioned individuals and networks connected to North Korean IT worker schemes that funnel crypto proceeds to Pyongyang. Our earlier coverage of Treasury sanctions targeting the DPRK IT worker crypto scheme sets out the sanctions landscape that now extends to this incident.
Accounting and Compliance Implications
For accounting firms and CFOs with exchange exposure
The most immediate question for any entity holding assets on Binance is whether those assets should be written down or impaired pending the exchange's own loss-coverage commitment. Binance has stated it will cover all losses using its SAFU fund and company funds, and that no user funds will be affected. However, until that commitment is formally documented and the exchange's financial capacity to honour it is independently verified, auditors face a disclosure decision. Firms should request written confirmation from Binance of the coverage commitment and assess whether this constitutes a contingent liability or a subsequent event requiring note disclosure under IFRS or US GAAP.
The frozen stablecoin figures are also material. If a client holds USDT, USDC, or other stablecoins through Binance, the existence of issuer-level freeze mechanisms is now a demonstrated, not theoretical, risk. Stablecoin holdings that could in principle be frozen by a third-party issuer may require reclassification away from cash equivalents, depending on the facts and the applicable standard. This is worth reviewing proactively rather than waiting for an auditor to raise it.
For firms that use crypto accounting software to record exchange balances, the gap between on-exchange reported balances and verifiable on-chain holdings has become a live audit concern. Balances that cannot be confirmed against block explorers or exchange API snapshots should be flagged as unconfirmed until Binance restores normal operations.
For compliance teams and AML officers
Elliptic has attributed blockchain addresses associated with the theft, and screening against those addresses is already possible for platforms that subscribe to blockchain analytics. Any transaction touching those addresses, whether directly or through subsequent hops, now carries a high sanctions-exposure risk given the DPRK attribution. Firms operating under OFAC jurisdiction in particular should ensure their transaction monitoring is ingesting the latest attacker address sets.
The EIP-7702 delegation mechanism used in this attack is technically novel and may not yet be covered by existing wallet risk models. Compliance teams should raise this with their blockchain analytics providers to confirm whether delegated smart contract control is reflected in address-risk scoring.
The withdrawal suspension also has direct AML reporting implications. Where a regulated firm had pending withdrawals from Binance at the time of the suspension, the inability to move or verify those funds may trigger internal escalation requirements depending on jurisdiction. This is worth reviewing with your MLRO.
Our detailed breakdown of the earlier Binance withdrawal suspension and its compliance consequences is available in our piece on Binance hack and withdrawal suspension accounting implications, which covers the structural compliance questions in more depth.
The OFAC angle also connects directly to ongoing North Korean sanctions enforcement. Our earlier analysis of OFAC sanctions targeting the DPRK IT worker crypto fraud network provides relevant background on how US authorities are building the enforcement picture around regime-linked crypto activity.
Frequently Asked Questions
Is Binance covering the losses, and does that affect my accounting treatment?
Binance has publicly committed to covering all losses from its SAFU fund and company funds, saying user funds will not be affected. For accounting purposes, this is a management representation. Auditors should obtain written documentation of the commitment and assess whether a contingent asset or liability exists. If the exchange is audited, request sight of the SAFU fund's current balance and any third-party confirmation of its adequacy. Until that verification is complete, a note disclosure may be appropriate.
What does the stablecoin freeze mean for how we classify stablecoin holdings?
The confirmed freezes of USDT and USDC demonstrate that stablecoin issuers can and do freeze individual addresses, including exchange hot wallets, at speed. If your entity holds stablecoins on-exchange, this event strengthens the case for reviewing whether those holdings meet the definition of cash equivalents under your applicable standard. The freeze risk, if material, may also warrant disclosure even where no freeze has directly affected your own holdings.
How should firms handle transaction screening given the DPRK attribution?
Elliptic has attributed on-chain addresses to the attacker, and those attributions are available for screening. Firms under OFAC jurisdiction should treat any transaction touching those addresses as a potential sanctions exposure and follow their standard OFAC escalation procedures. Given the DPRK attribution, the relevant SDN list entries and Executive Orders governing North Korea-related transactions apply. Contact your blockchain analytics provider to confirm address coverage.
Does EIP-7702 create a new audit risk for firms holding self-custody wallets?
EIP-7702 allows a standard Ethereum wallet to delegate transaction-signing authority to a smart contract. In this attack, the attacker used that mechanism to take control of a Binance hot wallet without stealing its private key. For firms using Ethereum-based self-custody or hot wallet infrastructure, this is a prompt to review whether EIP-7702 delegations are monitored as part of your key-management controls. Your custody provider or internal security team should confirm whether delegated authority events are logged and alerted on.
What are the tax implications if funds held on Binance are temporarily inaccessible?
Tax treatment of inaccessible exchange funds varies by jurisdiction and depends on whether a loss is considered realised. In the US, a loss is generally not deductible until it is fixed and determinable with reasonable certainty. If Binance makes users whole, no deductible loss arises. If a portion is ultimately unrecoverable, the timing of deductibility will depend on when that becomes clear. In the UK, HMRC's guidance on negligible value claims may be relevant for any tokens that become permanently inaccessible. Retain all records of balances, the exchange's coverage commitment, and any subsequent communications.
Source: Elliptic