Binance: ~$6.3B drained from hot wallets on ten chains in ~20 minutes, attributed to DPRK TraderTraitor
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
On 2026-10-29, starting at 20:05 UTC, attackers drained about $6.3B (TRM Labs: $6.36B at transfer-time prices; Chainalysis: $6.4B) from Binance hot wallets on ten blockchains: Ethereum (~$3.79B), Bitcoin (18,270 BTC, ~$1.47B), Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. Most of it left within about 20 minutes. Binance's preliminary finding is that a compromised DevOps engineer's laptop gave the attacker access to a service container that submitted unauthorized withdrawals. Binance has found no private-key leak and later reported further points of breach. On Ethereum, the attacker submitted 50 pre-signed EIP-7702 authorizations covering consecutive nonces, delegating the hot wallet to a sweeper contract that kept sweeping new inflows. The other chains received ordinary signed transfers. TRM therefore assesses that the hot-wallet signing system itself was made to sign transactions the attacker chose. TRM attributes the theft with high confidence to North Korea's TraderTraitor, the group the FBI named for the 2025 Bybit theft; Chainalysis says it was likely that group. Neither Binance nor a government has attributed it. Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council froze about $2.7B; Binance cites about $3B. The attacker still controls more than 420,000 ETH and 18,270 BTC (~$2.4B). Binance revoked the affected authorization and says it will cover all losses from SAFU and company funds. Withdrawals are paused for a rebuild of the withdrawal service, with resumption expected within about 48 hours.
What to do
- Exchanges, OTC desks, solvers and market makers: screen deposits and counterparties in real time against the addresses TRM Labs and Chainalysis have labelled for this theft, and watch for the BTC peel-chain and ETH consolidation outflows before you fill large orders
- EVM treasury and hot wallets: alert immediately when an externally owned account acquires code (an EIP-7702 delegation), and make the signing policy reject 7702 authorizations unless they are explicitly expected
- Signing services: treat a request to sign many authorizations across a range of nonces as a compromise indicator, and keep a tested, pre-approved way to sign a revocation
- Separate signing infrastructure and approval paths by chain and wallet tier, so that one container or engineer workstation cannot get valid signatures on every chain
- Keep DevOps engineer endpoints off any network path that can submit to hot-wallet signing or withdrawal services; require hardware-backed, per-action approval for withdrawal submission
- Binance users: follow updates only through Binance's official channels; expect phishing that impersonates the incident, refund or withdrawal-resumption notices
Sources
All live incidents on Threat Watch
