The largest theft in crypto history was over in a few hours. Following the money will take years.
On 29 October 2026, attackers emptied the hot wallets of Binance, the world’s largest cryptocurrency exchange, on ten different blockchains. Hot wallets are the internet-connected wallets an exchange uses to pay out withdrawals. Blockchain analytics companies such as Iknaio, Chainalysis, or TRM Labs put the loss at USD 6.36 billion, about four times the USD 1.5 billion stolen from Bybit in February 2025, the previous record. Two days later, the FBI attributed the theft to North Korea and named the same actor behind Bybit: a group it calls “TraderTraitor”.
How the money left
Binance has not yet published a root cause. According to Blockchain analytics companies, on Ethereum the attacker abused EIP-7702, a 2025 feature that lets a wallet hand over its behaviour to a smart contract. Once the hot wallet had signed one such authorisation, it quietly forwarded every new deposit to the attacker, and the sweeps continued for hours. Bitcoin (18,270 BTC, about USD 1.47 billion), Tron, XRP, Solana and other networks were emptied with ordinary signed transfers, which suggests the attackers had gained control of the exchange’s transaction-signing system itself.
The race after the theft
Stealing is only the first step: the money still has to be laundered before it can be spent. Within an hour, stablecoin issuers began freezing tokens. Tether froze 971 million USDT and Circle 823 million USDC, and by the early hours of 30 October about USD 2.7 billion had been frozen. Meanwhile, the attackers swapped hundreds of millions in stablecoins for ether on decentralised exchanges, accepting a discount of around 10% to move fast. The FBI expects the funds to pass through DeFi protocols and instant-swap services; converting them into cash can take weeks or years and may require paid intermediaries.
Binance is not an isolated case. Chainalysis estimates that North Korean actors stole at least USD 2.02 billion in 2025 alone, and USD 6.75 billion in total up to that year. The Binance heist almost matches that figure in a single attack. The laundering infrastructure is just as persistent: in November 2025, Europol supported German and Swiss authorities in shutting down Cryptomixer, a mixing service suspected of laundering over EUR 1.3 billion in bitcoin since 2016.
The next wave: scams around the heist
Theft of this size also creates a second wave of victims. Binance says it will absorb the losses and has asked users to rely only on its official channels, but confusion is exactly what fraudsters exploit: fake support agents, phishing sites promising “refunds” and bogus fund-recovery services. The FBI has warned since 2024 about fraudsters posing as lawyers or recovery firms to target people who have already lost crypto, with reported losses of over USD 9.9 million in one year. As the FBI reminds victims, law enforcement never charges a fee to investigate a crime.
Infographic created with AI (Claude, Anthropic). Data: TRM Labs, FBI.
What we do in ENSEMBLE
Cases such as this demonstrate that the most critical investigative work often begins after the theft has occurred. Investigators must trace thousands of addresses across multiple blockchains, identify connections to a common actor, and pinpoint when stolen funds reach services or platforms where accountability can be enforced.
Within the ENSEMBLE project, Iknaio and Vicomtech will build upon and further enhance their respective tools, GraphSense and Kriptosare, to develop advanced crypto-asset tracing methodologies that harness the potential of artificial intelligence (AI) and workflow automation. These developments aim to improve both the efficiency and effectiveness of cryptocurrency investigations. Key activities will include establishing collaborative wallet attribution approaches, developing innovative techniques to correlate transaction flows across different blockchain ledgers, and applying classification and link-prediction techniques to infer the potential nature (e.g., exchanges or mixers) or identity of pseudonymous wallets.
Written by María González Herrero from Vicomtech.
REFERENCES
FBI (31 Oct 2026). North Korea Responsible for $6 Billion+ Binance Attack. fbi.gov
FBI / IC3 (26 Feb 2025). North Korea Responsible for $1.5 Billion Bybit Hack, PSA I-022625-PSA. ic3.gov
TRM Labs (29 Oct 2026). North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History. trmlabs.com
Chainalysis (30 Oct 2026, upd. 3 Nov). The $6.4 Billion Binance Hack: Tracing the North Korea Link. chainalysis.com
Chainalysis (18 Dec 2025). 2025 Crypto Theft Reaches $3.4 Billion. chainalysis.com
Europol (Dec 2025). Europol and partners shut down ‘Cryptomixer’ – EUR 25 million in cryptocurrency seized. europol.europa.eu
eucrim (5 Feb 2026). “Cryptomixer” Taken Down. eucrim.eu
FBI / IC3 (24 Jun 2024). Fictitious Law Firms Targeting Cryptocurrency Scam Victims Offering to Recover Funds, I-062424-PSA. ic3.gov
FBI / IC3 (13 Aug 2025). Fictitious Law Firms Targeting Cryptocurrency Scam Victims Combine Multiple Exploitation Tactics…, I-081325-PSA. ic3.gov
McAfee (30 Oct 2026), relaying Binance’s 29 Oct statement on official channels. mcafee.com
Korea Herald / AP (1 Nov 2026), reporting the FBI statement. koreaherald.com
