Table of Contents
Executive Summary
Late on 29 October 2026, roughly ten of Binance’s hot wallets were emptied at once. The attackers made off with an estimated $6.43 billion in crypto, most of it gone inside about twenty minutes. No theft on record comes close — the haul is around four times the $1.5 billion stolen from Bybit in 2025.
The incident is notable not for broken cryptography but for how the funds left. Binance found no evidence that any wallet private key was leaked. Instead, the attacker made the exchange’s own withdrawal infrastructure sign and send transactions to attacker-controlled addresses — the approval path meant to stop unauthorized withdrawals signed them instead.
The entry point, by Binance’s account, was a compromised DevOps engineer’s laptop. Later updates went further, reporting additional points of breach; co-CEO Richard Teng described a complex attack “not carried out by one person.” Attribution came quickly after. TRM Labs, a blockchain-analytics firm, tied the theft to TraderTraitor — a North Korean state-sponsored group in the Lazarus orbit — and the FBI later reached the same conclusion.
Withdrawals were paused while Binance worked with stablecoin issuers and law enforcement to freeze about $3 billion on-chain. The exchange promised to make customers whole from its Secure Asset Fund for Users (SAFU) and its own reserves, then began reopening withdrawals in phases on 1 November; by that point roughly 95% of the affected assets had been replenished. A full technical post-mortem has yet to appear. If there is a single lesson here, it is that one privileged engineering endpoint can lead straight to exchange funds.
What Happened
The outflows began at 20:05 UTC on 29 October 2026. Within moments, unauthorized withdrawals were leaving Binance’s hot-wallet infrastructure on about ten chains in parallel — Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon — and an estimated $6.43 billion was already moving to attacker-controlled wallets.
Because each transaction carried valid signatures from Binance’s own systems, every chain treated it as legitimate. Binance confirmed the breach within hours, froze withdrawals and revoked authorization for the affected addresses. Early on-chain tracing put the loss at about $6.36 billion as of the moment of theft; Binance’s fuller disclosure on 3 November raised that to $6.43 billion.
Attack Chain
How the Attackers Got In
Binance’s initial Security Incident Update (30 October) reported only that the breach may have involved a compromised DevOps engineer’s laptop with access to a service container able to submit withdrawal transactions, and found no evidence of a wallet private key leak. Its fuller disclosure on 3 November confirmed something larger: a sophisticated, multi-stage campaign that Binance stressed was “not a single isolated breach or a simple phishing incident,” chaining a supply-chain compromise, recruitment-themed social engineering against two engineers, and abuse of an internal AI tool.
Stage 1 — Supply-chain compromise (June 2026). An engineer on the wallet DevOps team (“Engineer A”) searched the web for an AI tool and ran a trojanized Homebrew installer. Binance detected the intrusion and rotated the affected credentials, but the attacker had already harvested details of Engineer A’s role and of colleagues across the wallet-infrastructure team.
Stage 2 — Fake recruitment (September 2026). The attacker approached a second engineer (“Engineer B”) through a legitimate job platform while posing as a project director. A first video interview with a bogus HR representative — who shared a social-media profile with personal photos to build credibility — was followed by a second interview with someone impersonating the CEO of a non-existent company. Near the end, Engineer B was told to download an “assignment” code repository onto their work computer; its setup process executed malicious code that swapped a legitimate developer-tool component for a poisoned version, beaconed to an attacker-controlled server, and deleted forensic artifacts.
Stage 3 — Lateral movement via internal AI tooling (October 2026). On 20 October the attacker used Engineer B’s compromised machine to abuse an internal AI tool, pivoting to Engineer A and a third engineer (“Engineer C”), and recovered a container-deployment permission token from Engineer A’s device. On 29 October, between 17:15 and 19:56 UTC, the attacker logged into Engineer C’s computer, used the stolen token to deploy a container, and triggered a malicious script.
That foothold reached the internal wallet signing service, which the attacker used to initiate transactions that bypassed the normal withdrawal process — the signing path approving the drain described below. The earlier “single compromised laptop” account was thus an early, partial picture; consistent with it, no wallet private key was ever stolen.
Technical Analysis: The EIP-7702 Drain
The clearest technical fingerprint appeared on Ethereum. The attacker used EIP-7702 — a feature from the 2025 Pectra upgrade that lets an account delegate its behaviour to contract code — to empty a Binance hot wallet. It took a single transaction: it bundled 50 authorizations signed by that wallet, and each one handed control of the account to an attacker-controlled sweeper contract.
Two choices made it reliable: the 50 authorizations covered consecutive nonces, guaranteeing one would be valid at execution; and each carried the hot wallet’s genuine signature, so the authority came from Binance’s own signing path. About three and a half minutes later, the wallet’s full balance — 167,464 ETH and 1.615 billion USDT — moved to the attacker, alongside 18,270 BTC and 612.7 million USDT on Tron, and 233.46 million XRP, with Solana and Optimism following within minutes.
Apart from the EIP-7702 sweep, funds left through ordinary signed transfers. TRM Labs assessed this as a compromise of Binance’s hot wallet signing infrastructure — an attacker who controlled what the signing system approved, not one holding raw keys.
Timeline (UTC)
Time | Event |
Jun 2026 | Supply-chain compromise: a wallet-DevOps engineer (“Engineer A”) runs a trojanized Homebrew installer; Binance rotates the credentials, but team details are exposed. |
Sep 2026 | Fake recruitment: “Engineer B” is lured via a job platform; staged HR and “CEO” interviews end with a malicious “assignment” repo that plants malware on their work machine. |
20 Oct | Lateral movement: the attacker abuses an internal AI tool from Engineer B’s machine to reach Engineers A and C, and steals a container-deployment token. |
29 Oct, 17:15–19:56 | Intrusion: the attacker logs into Engineer C’s computer, deploys a container with the stolen token, and triggers a malicious script. |
29 Oct, 20:05 | Multi-chain drain begins; five Binance wallets send 233.46M XRP to one attacker address. |
29 Oct, 20:20–20:24 | EIP-7702 sweep empties an ETH hot wallet (~167,464 ETH + 1.615B USDT); ~18,270 BTC and 612.7M USDT on Tron also move. |
29 Oct, 21:01–21:04 | Tether freezes ~971M USDT; Circle freezes ~823M USDC. |
29 Oct, ~22:30 | Binance confirms a security incident and pauses withdrawals. |
30 Oct, 00:30 | TRM Labs attributes the theft to TraderTraitor with high confidence. |
30 Oct | Binance publishes its first incident update, then reports additional points of breach; ~$3B frozen on-chain. |
31 Oct | FBI, with USSS and IRS-CI, officially attributes the theft to North Korea’s TraderTraitor. |
1 Nov | Withdrawals reopen in phases; ~95% of the impact covered with company funds. |
3 Nov | Binance discloses the full multi-stage campaign — trojanized Homebrew, fake recruitment, internal AI-tool abuse — and puts the total at ~$6.43B. |
Impact and Response
Stablecoin issuers did most of the rapid containment, because centralized stablecoins can blacklist any address holding their tokens. Tether froze over $1.56 billion in USDT and Circle over $800 million in USDC, with Ripple, World Liberty Financial, First Digital, Aave and the Arbitrum Security Council taking further action — about $3 billion frozen in total, close to half the loss. The first large freezes landed within about 40 minutes of the main Ethereum sweep. This speed is a genuine safety mechanism, though it also underlines that “decentralized” assets often carry a central kill switch.
Binance paused and rebuilt its withdrawal service, engaged law enforcement and analytics partners, reserved more than 6.34billionincompanyfundstocoverlosses,andpledgedSAFUcoveragesouserswouldnotlosefunds.Withdrawalsreopenedinphasesfrom1November,roughly95%ofaffectedassetswerereplenished,andazero-knowledgeProofofReserveswaspublishedfortenmajortokens.Marketsreactedsharply—Bitcoinfellbelow~80,000 and BNB dropped ~7–10% — but Binance.US was unaffected.
Attribution
TRM Labs and Chainalysis attributed the theft with high confidence to TraderTraitor (North Korea, Lazarus/APT38), citing on-chain overlaps with earlier heists — Tornado Cash staging, pre-signed signatures — and commingling with proceeds of the September 2026 Bitget exploit. On 31 October, the FBI, with the U.S. Secret Service and IRS-CI, issued an official finding naming North Korea, published the attacker addresses, and asked exchanges and DeFi services to block related funds. The tradecraft closely mirrors the 2025 Bybit hack, which the FBI also attributed to the same group.
How It Compares
Three major 2025–26 incidents, all tied to North Korea-linked actors:
| Binance (2026) | Bybit (2025) | KelpDAO (2026) |
Amount | ~$6.3–6.4B | ~$1.5B | ~$292M |
Vector | Hot wallet signing infrastructure compromise; DevOps laptop + more breach points | Compromised machine at wallet provider Safe{Wallet} | LayerZero single-verifier bridge exploit |
Key abuse | EIP-7702 sweep; valid signatures | Legitimate multisig signing flow manipulated | Cross-chain message verification bypass |
Attribution | TraderTraitor (FBI) | TraderTraitor (FBI) | Lazarus/TraderTraitor (suspected) |
Record status | Largest crypto hack ever | Largest at the time | Largest DeFi exploit of 2026 then |
Binance and Bybit share a structure: a compromised developer machine leading to a legitimate signing system approving the attacker’s transactions.
Lessons and Recommendations
- Protect the signing path, not just the keys. No private key was stolen, yet $6.3B moved. Controls that decide what gets signed are part of the attack surface.
- Treat privileged endpoints as tier-zero. DevOps and engineering laptops that can reach production signing need strict device posture, phishing-resistant MFA and short-lived credentials.
- Isolate and rate-limit withdrawals. Separate signing by chain and wallet tier, and add velocity limits and anomaly holds so no single foothold can drain every network at once.
- Monitor new protocol features. Reject unexpected EIP-7702 authorizations and alert on batches of authorizations spanning a range of nonces.
- Rehearse ecosystem response. Pre-establish contacts with stablecoin issuers, analytics firms and law enforcement so freezes can happen in minutes.
- Train staff against recruiter lures. Fake job offers and trojanized tools are TraderTraitor’s favored initial access.
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
