$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor

What it is

On 29 October 2026, attackers took about $6.36 billion from Binance wallets across ten blockchains, most of it in roughly 20 minutes (TRM Labs figure; Binance says about $6.3 billion). Binance's early finding is a compromised DevOps engineer's laptop, which gave access to a service container that submitted unauthorized withdrawals. Binance says it has found no evidence of a wallet private key leak.

How it works

The attackers prepared for at least a day and a half. The operator wallet was funded with a few small Tornado Cash withdrawals, and the malicious code was tested on other wallets before the live run.

On Ethereum they used EIP-7702, which lets a standard wallet delegate its behavior to a smart contract by signing a permission. They sent a batch of 50 permissions, all signed beforehand by a Binance hot wallet, so that one would match the wallet's transaction count at execution time. The wallet ended up delegated to a contract only the attackers controlled, and they used it to empty the wallet.

TRM says this first looked like phishing. That does not explain the other nine chains, where Binance wallets sent funds through ordinary, validly signed transactions. Those chains use different key types and signing schemes, yet all produced valid signatures within about half an hour. TRM's assessment is that the attacker could make Binance's hot wallet signing system sign transactions of their choosing across chains.

flowchart TD
    A[Compromised DevOps laptop] --> B[Service container access]
    B --> C[Hot wallet signing system]
    C --> D[Ethereum: 50 pre-signed EIP-7702 delegations]
    C --> E[Nine other chains: valid signed transfers]
    D --> F[Wallet drained]
    E --> F

Attribution

TRM attributes the attack to North Korea's TraderTraitor with high confidence. Shared traits with the Bybit heist (February 2025, $1.5 billion) and the KelpDAO hack (April 2026) are a mixer-funded operator wallet, long preparation, and signatures collected ahead of time and used all at once. The FBI attributed Bybit to TraderTraitor. Chainalysis CEO Jonathan Levin also names TraderTraitor, after finding proceeds from the Bitget exploit mixed with Binance funds. ZachXBT names the Lazarus Group. Binance has not named a culprit.

Laundering and recovery

Unlike Bybit, the attackers have mainly used large trades with market makers and lending platforms rather than cross-chain bridges. To outrun freezes they sold USDT for ETH at more than 10% below market.

By 00:30 UTC on 30 October, TRM counted about $2.7 billion frozen, including roughly 1.77 billion USDT (Tether) and about 825 million USDC (Circle). Ripple and World Liberty Financial froze smaller amounts. Arbitrum's Security Council moved about $30 million out of an attacker wallet. Binance puts the frozen total near $3 billion. TRM says the attackers still hold over 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze.

Caveats

The laptop-to-container path is Binance's preliminary finding. The signing-system compromise is TRM's most likely explanation, not a confirmed one. The article gives no indicators of compromise or defensive guidance. Binance has halted withdrawals and says it will reimburse all losses from company funds and its SAFU fund.