Skip to content

Back to the catalog

en.cryptonomist.charticle

Binance Replaced 90% of Assets Stolen in the $6.3B Binance Crypto Hack

Report on the $6.3 billion Binance hack of October 2026, which the FBI attributed to North Korea's TraderTraitor unit. Co-CEO Richard Teng said attackers used EIP-7702 to gain execution approval over a hot wallet, after a compromised laptop and further breach points, and used self-destructing malware. Binance replaced 90% of the assets, and the FBI expects further laundering through Ethereum. No IOCs or mitigations are given.

TL;DR Relays Binance's account of a $6.3B North Korean TraderTraitor hot-wallet theft via EIP-7702, with recovery and laundering status.
Open original ↗

Organisations named here

  • Binance
  • Chainalysis
  • FBI
  • Richard Teng
  • TRM Labs
  • US Secret Service

Technologies named here

  • Chainalysis
  • TRM Labs
  • EIP-7702
  • Ethereum
  • Proof of reserves
  • SAFU fund

Standards and laws named here

  • EIP-7702

Techniques named here

  • Abuse of EIP-7702 for on-chain execution approval
  • Compromised laptop / endpoint breach
  • Cryptocurrency laundering via Ethereum conversion
  • Self-destructing malware (indicator removal)

Concepts named here

  • Proof of reserves
  • Asset replacement
  • Attribution to North Korea
  • Fund commingling
  • Multi-actor intrusion

Threat actors named here

  • North Korea
  • TraderTraitor

Related in Blockchain