Finance Featured

The Biggest Heist in History Took 20 Minutes

North Korea drained $6.3 billion from Binance across ten blockchains — most of it in about 20 minutes. How the attack worked, why the stablecoin freeze race clawed back $2.7 billion, and what the record heist reveals about where power actually sits in crypto.

Alpha One

02 Nov 2026 • 7 min read

At five minutes past eight on the evening of Thursday, October 29 — 20:05 UTC — five Binance wallets on the XRP Ledger quietly began sending out everything they held. Four minutes later they were empty shells, drained down to their minimum balances. By 20:20, a Binance Bitcoin hot wallet had pushed out 18,270 BTC in a single transfer. Within two more minutes, more than $600 million left the exchange's Tron wallet. Before midnight, wallets on ten different blockchains — Ethereum, Bitcoin, Tron, XRP, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon — had handed their contents to a single attacker.

The total, as traced by blockchain intelligence firm TRM Labs: approximately $6.36 billion, most of it moved in about 20 minutes. That makes October 29, 2026 the largest cryptocurrency theft ever recorded — roughly four times the $1.5 billion Bybit hack of February 2025, the previous record holder. Measured against physical robberies, it is almost certainly the largest heist of any kind in history.

On Saturday, the FBI removed the suspense about who did it: "The Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the bureau said in a statement, tying the operation to TraderTraitor — the same state-sponsored unit it blamed for Bybit.

This is the story of how the biggest exchange in crypto lost a nine-figure sum per minute, why the response worked better than anyone had a right to expect, and what the whole episode reveals about where power actually sits in digital markets.

A heist rehearsed in advance

What distinguishes this attack from a smash-and-grab is the preparation. According to TRM's forensic reconstruction, the attacker's operator wallet was funded on the morning of October 28 — more than 36 hours before the theft — with three small withdrawals from Tornado Cash, a service that obscures the origin of funds. Early on October 29, the operator deployed a first version of its attack code and tested it on two wallets. Later that day it rehearsed the final version on a third wallet, routed the test funds back to itself, and waited. Four hours after the rehearsal, the same code was installed on one of the best-known Binance hot wallets on Ethereum.

The Ethereum portion of the theft used a feature called EIP-7702, introduced in the network's May 2025 Pectra upgrade, which lets an ordinary wallet delegate its behavior to a smart contract by signing an authorization. The attacker arrived with 50 pre-signed authorizations, each valid at a different transaction count, guaranteeing that at least one would land no matter how fast the busy withdrawal wallet's counter moved. One did. Three minutes and 24 seconds later, the operator ordered the wallet to send out its entire balance — 167,464 ETH and 63 different tokens, including 1.615 billion Tether — in one transaction. The delegation stayed in place afterward, so the attacker simply swept the wallet again six more times through the night as new customer deposits flowed in.

But here is the detail that should concern every exchange on the planet: the Ethereum trick explains only one chain. In the same half-hour window, Binance wallets on nine other networks — different chains, different key types, different signing schemes — all produced valid, ordinary signed transfers to the attacker. In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing infrastructure sign whatever it wanted, across chains. Binance's own preliminary account, as reported by German public broadcaster Tagesschau, points to a compromised laptop belonging to an IT employee, which may have given the attacker access to a service container able to trigger withdrawal requests. Binance says it has found no evidence that private keys themselves were stolen, and has promised a full technical report once its investigation concludes.

Briefings like this are free to read with a free AlphaBriefing membership. Join free →

The freeze race

What happened next was the most consequential 90 minutes in stablecoin history — and the clearest demonstration yet of a power most crypto investors prefer not to think about.

More than half the stolen haul was in stablecoins: roughly 2.5 billion in Tether across chains, 823 million USDC, 88.5 million of Ripple's RLUSD, 27.8 million of World Liberty Financial's USD1. Unlike Bitcoin or Ether, those tokens have issuers — companies that can freeze any address at will. And they did. Tether froze the main receiving wallet 37 minutes after the main sweep. Circle locked up the 823 million USDC within the hour, in coordination with law enforcement. Ripple and World Liberty Financial followed. Arbitrum's Security Council went a step further, using its emergency powers to forcibly move about $30 million in ETH and ARB out of the attacker's own wallet. By TRM's count, roughly $2.7 billion — over 40% of the haul — was frozen within hours.

The attacker understood the clock perfectly and paid dearly to beat it. In the first hours, it dumped about 325 million USDT to professional market makers in exchange for roughly 122,300 ETH — effectively paying around $2,650 per ETH when the market traded near $2,300 to $2,350, a discount of more than 10% just to get out of freezable assets. It borrowed another ~19,760 ETH against Tether collateral on the lending protocol Aave before Aave froze the affected markets. Everything it managed to convert into Bitcoin and Ether — assets no company can freeze — it kept. As of TRM's October 30 snapshot, that unreachable pile stood at more than 420,000 ETH and 18,270 BTC: about $2.4 billion, which on its own would still rank as the largest crypto theft ever. The Bitcoin began moving through "peel chains" — splitting into round 1,000 and 100 BTC pieces within the same block — the classic opening move of a laundering operation that, in the Bybit case, took weeks and still succeeded.

The $6.34 billion check

Binance's response followed the playbook it helped invent after earlier industry failures: eat the loss. The exchange suspended withdrawals, told users their funds were "safe," and said on Saturday it was deploying more than $6.34 billion in company funds to buy back tokens and replenish roughly 90% of what was stolen, with the remaining, less-liquid 10% to follow. On Sunday it began resuming withdrawals in phases, starting with 15 major assets including Bitcoin, Ether, XRP, and Dogecoin.

Customers took the exit anyway — at least at first. Reported net outflows ran from about $3.6 billion in the first hours of resumed withdrawals (CNBC, The New York Times) toward $4.7–5 billion as services fully restarted (Bloomberg, Financial Times), before Binance said the exit rush was slowing. For the industry's largest exchange, that looks like a stress test passed, not a bank run — so far.

Markets absorbed the blow with less drama than the headlines suggested. Bitcoin fell about 4.3% on the day of the attack, from $81,268 to $77,775, and trades near $77,800 today (Yahoo Finance data). BNB, the token at the center of Binance's ecosystem, dropped roughly 8% on October 29 and has clawed back only part of it, around $705. The absence of contagion is itself information: the market judged this a Binance operational failure and a North Korea problem, not a solvency event.

What the heist actually revealed

Three uncomfortable lessons sit underneath the headline number.

First, the industry's immune system now depends on central actors. The only reason this is a $2.4 billion theft instead of a $6.4 billion one is that four companies and one emergency council froze assets by decree within hours. That is precisely the kind of discretionary, centralized intervention crypto was designed to make impossible — and it is now, demonstrably, the system's main line of defense. Investors holding stablecoins should understand both sides of that coin: your assets can be rescued by the freeze button, and they are permanently subject to it.

Second, the attack surface has moved from keys to infrastructure. Nobody cracked cryptography on October 29. The attacker compromised the system that asks for signatures — reportedly starting from one employee laptop — and every chain Binance operated on obeyed. Exchanges have spent a decade hardening private keys in vaults and multi-party setups; TraderTraitor went around all of it, exactly as it did at Bybit twenty months earlier. The FBI's statement pointedly asked exchanges, bridges, and analytics firms to block the flagged addresses, because prevention has already failed twice at record scale.

Third, this is state financing, not cybercrime. U.S. agencies have for years assessed that North Korea's stolen crypto flows fund the regime, including its sanctioned weapons programs. If the attacker ultimately keeps even the $2.4 billion beyond the issuers' reach, a single evening's work would eclipse the entire Bybit haul — until last week the largest crypto theft ever — by nearly a billion dollars. The heist, in other words, now sits somewhere between a sanctions-evasion scheme and an act of economic statecraft — carried out against a private company, settled on public ledgers, and visible to anyone in real time.

The biggest heist in history took about 20 minutes. The response — the freezes, the buyback, the attribution — took a weekend. The laundering battle for the remaining $2.4 billion will take months, and it is the part worth watching: Bybit proved the money can disappear even with the whole world watching the wallets.

If this analysis was useful, this is what AlphaBriefing does every day — geopolitics and markets, connected to what it means for your money. A free membership gets you access to every free article on AlphaBriefing.com; paid members get the investment frameworks, scenario pricing, and catalyst calendars behind the paywall.

Get this level of intelligence every day. Join AlphaBriefing free → — upgrade whenever it earns it.

Sources & Further Reading

Disclaimer

AlphaBriefing is an independent intelligence publication. The content in this article is produced for informational and educational purposes only. Nothing published by AlphaBriefing constitutes financial, investment, legal, tax, or regulatory advice, nor should it be construed as a solicitation or recommendation to buy, sell, or hold any security, asset, or financial instrument.

All views expressed are those of the author at the time of writing and are subject to change without notice. Markets are volatile and unpredictable; past performance is not indicative of future results. Any investment involves risk, including the possible loss of principal.

AlphaBriefing and its principals, employees, or contributors may hold positions in securities or assets mentioned in this article. This should be considered a potential conflict of interest. No material relationship with any company referenced exists unless explicitly disclosed. Readers should conduct their own due diligence and consult qualified financial, legal, and tax advisors before making any investment decisions.

Information in this article is drawn from public sources believed to be reliable at the time of publication. AlphaBriefing makes no warranty, express or implied, as to the accuracy, completeness, or timeliness of any information herein. AlphaBriefing accepts no liability for any loss or damage arising from reliance on this content.