Binance: ~$6.3B drained from hot wallets on ten chains, attributed to North Korea's TraderTraitor
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
Starting 2026-10-29 at 20:05 UTC, Binance hot wallets on ten blockchains were drained of roughly $6.3B, most of it within about 20 minutes. Binance puts the impact at about $6.3B; TRM Labs values the transfers at $6.36B at transfer-time prices ($6.23B at current prices); Chainalysis says $6.4B and Elliptic $6.43B. Binance's preliminary finding is that a compromised DevOps engineer's laptop may have let the attacker reach a service container that submitted unauthorized withdrawals. Binance says it found no wallet private-key leak, reported further breach points beyond the laptop on 2026-10-30, and has not published a root cause. On Ethereum, 50 pre-signed EIP-7702 authorizations at consecutive nonces turned a hot wallet into a sweeper the attacker controlled; the other nine chains received ordinary signed transfers, which TRM reads as compromise of the hot-wallet signing system. Attribution: TRM Labs assesses North Korea's TraderTraitor with high confidence. Chainalysis says DPRK's TraderTraitor, with its CEO calling it 'likely' on X and The Record quoting a 'high degree of confidence that DPRK'. Elliptic also names TraderTraitor. StepSecurity and Elliptic report that the FBI, with the US Secret Service and IRS Criminal Investigation, attributed the theft to TraderTraitor on 2026-10-31; the FBI alert itself returned HTTP 403 to our fetcher and was not read directly. Binance has not named any group or individual. Issuers and Arbitrum's Security Council froze about $2.7B by TRM's count; Binance cites about $3B. TRM says the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4B beyond issuer reach. Binance says it will cover all losses from SAFU and company funds, said on 2026-10-31 that about 90% of impacted assets had been replenished, and has paused withdrawals while it rebuilds the withdrawal service, targeting resumption on 2026-11-01.
What to do
- Exchanges, OTC desks, solvers and market makers: screen deposits and counterparties in real time against the addresses TRM Labs and Chainalysis have labelled for this theft, and watch for the BTC peel-chain and ETH consolidation outflows before you fill large orders
- EVM treasury and hot wallets: alert immediately when an externally owned account acquires code (an EIP-7702 delegation), and make the signing policy reject 7702 authorizations unless they are explicitly expected
- Signing services: treat a request to sign many authorizations across a range of nonces as a compromise indicator, and keep a tested, pre-approved way to sign a revocation
- Separate signing infrastructure and approval paths by chain and wallet tier, so that one container or engineer workstation cannot get valid signatures on every chain
- Keep DevOps engineer endpoints off any network path that can submit to hot-wallet signing or withdrawal services; require hardware-backed, per-action approval for withdrawal submission
- Binance users: follow updates only through Binance's official channels; expect phishing that impersonates the incident, refund or withdrawal-resumption notices
Sources
All live incidents on Threat Watch
