31 results for “Binance”

StepSecurity's analysis of Binance's 29 October 2026 incident, which Binance puts at about $6.3 billion in affected assets. It covers Binance's disclosure of a possible DevOps laptop compromise, and TRM Labs and Elliptic findings on 50 EIP-7702 authorizations and a persistent delegation. It links this to the Nx, OVHcloud CLI and Claude Code extension compromises, gives an investigation checklist, then describes StepSecurity products.

stepsecurity.ioarticlePublished and added 30 Oct 2026🛡️ Security

Galaxy Research's weekly brief of 30 October 2026 opens with the Binance hack: about $6.3b drained across 10 blockchains, attributed by TRM Labs and Chainalysis to TraderTraitor (Lazarus-linked). The attacker used EIP-7702 with 50 pre-signed authorizations on Ethereum, and Binance's preliminary finding is a compromised DevOps laptop reaching a service container. Tether and Circle froze about $2.6b. The other sections cover Hyperliquid and prediction markets.

galaxy.comarticleAdded 30 Oct 2026🛡️ Security

Galaxy Research newsletter on the roughly $6.3b drained from Binance across 10 blockchains, which TRM Labs and Chainalysis attribute to TraderTraitor. On Ethereum the attacker used EIP-7702 to turn a hot wallet into a sweeper contract backed by 50 pre-signed authorizations. Binance's preliminary finding is a compromised DevOps laptop, with no wallet key leak. Tether, Circle, Ripple and World Liberty froze about $2.7b; Galaxy also assesses Binance's ability to cover losses.

galaxy.comarticleAdded 30 Oct 2026🛡️ Security

Bankless report on the Binance hack of $6.3 billion, which Binance's preliminary investigation traced to a compromised DevOps engineer's laptop with access to withdrawal-authorizing systems. TRM Labs found valid EIP-7702 authorizations on Ethereum, and nine other chains were drained through normally signed transactions. TRM and Chainalysis link it to North Korea's TraderTraitor. Tether and Circle froze about $3 billion, and Binance says SAFU and corporate cash will cover the losses.

bankless.comarticlePublished and added 30 Oct 2026🛡️ Security

Decrypt reports that Binance is working with the FBI and U.S. Secret Service after a theft of about $6.4 billion, which TRM Labs and Chainalysis attribute to North Korea's TraderTraitor group, also linked to the February 2025 Bybit hack. Circle froze about $823 million in USDC and Tether froze USDT, though the page gives differing Tether totals. Binance first suspected a compromised DevOps engineer laptop, found more breach points, and saw no evidence of leaked wallet private keys.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

Decrypt reports on the October 2026 Binance hot-wallet hack, about $6.3 billion, which Binance CEO Richard Teng says the company will cover with over $6.34 billion of its own funds. Teng says the attacker used an EIP-7702 delegation that skipped Binance's approval controls, a self-destruct mechanism to wipe tooling, and more than one breach point beyond a compromised laptop. TRM Labs and Chainalysis attribute the theft to TraderTraitor, and the attacker is still moving funds on Tron.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

The Defiant reports that Binance co-CEO Yi He's colleague Teng says the attacker in a breach Binance estimates at $6.3 billion used EIP-7702 to bypass wallet controls. Binance is rebuilding its withdrawal service, and attackers destroyed tools and traces during the intrusion. Only the teaser loaded, so the technical detail of the EIP-7702 abuse is not in the available text.

thedefiant.ioarticlePublished and added 30 Oct 2026🛡️ Security

Protos analysis of how the Binance hack played out on Ethereum. The attacker deployed a sweeper contract and sent 50 EIP-7702 authorizations for the Binance 14 hot wallet, signed with its key and using varied nonces to match the wallet's changing count. Other wallets and EVM chains used plain transfers. Binance later removed the delegation, and about $2.4 billion in funds was frozen or blacklisted.

protos.comarticlePublished and added 30 Oct 2026🛡️ Security

Binance hack analysis from 21shares on the 29 October 2026 theft of about $6.3 billion from Binance. Binance's initial finding points to a compromised DevOps engineer's laptop with no sign of a leaked wallet key. Chainalysis attributes it to North Korea with high confidence, and about $3 billion was frozen by Tether, Circle and the Arbitrum Security Council. The attacker also borrowed about $44.6 million of WETH on Aave. Binance says SAFU and company funds will cover all losses.

21shares.comarticlePublished and added 30 Oct 2026🛡️ Security

EIP-7702 ("Set Code for EOAs") is the Ethereum change, live since the Pectra upgrade on 7 May 2025, that lets ordinary wallets delegate to smart contract code. The guide covers set-code transactions, delegation indicators, batching, sponsorship and sweeper-contract scams. It then describes the 29 October 2026 Binance theft of about $6.4B, which TRM Labs and Chainalysis attributed to TraderTraitor, where 50 pre-signed authorizations turned a hot wallet into a sweeper.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

Aikido Security's analysis of the roughly $6.3 billion Binance incident, which Binance says may have started with a compromised DevOps engineer's laptop. It sets out what is known (no private key leak, TraderTraitor attribution by TRM Labs and Chainalysis, additional breach points) and a plausible chain from laptop credentials to a withdrawal service. It compares the 2025 Bybit theft and lists mitigations.

aikido.devarticlePublished and added 30 Oct 2026🛡️ Security

TRM Labs and Chainalysis attribute the October 2026 Binance theft, about $6.4 billion across 10 blockchains, to North Korea's TraderTraitor. On Ethereum the attacker used EIP-7702 delegation with 50 pre-signed authorizations to turn a hot wallet into a sweeper, pointing to compromised signing infrastructure. The attacker funded wallets via Tornado Cash, laundered through automation and Aave borrowing, and about $3 billion was frozen.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

Report on the 29 October 2026 Binance theft, which TRM Labs valued at USD 6.36 billion across ten chains, mostly within 20 minutes. TRM attributes it with high confidence to North Korea's TraderTraitor. The attacker used pre-signed EIP-7702 delegations to turn a Binance Ethereum hot wallet into a sweeper. About USD 3 billion was frozen; TRM advises monitoring for unexpected delegations and separating signing infrastructure.

en.cryptonomist.charticlePublished and added 30 Oct 2026🛡️ Security

Chainalysis assesses the 29 October 2026 theft of about $6.4 billion from Binance hot wallets as the work of North Korean group TraderTraitor. Attribution rests on on-chain behavior, including real-time commingling with funds from the Bitget exploit, a Tornado Cash-funded operator wallet and signed authorizations that let a hot wallet run attacker code. About $2.8 billion was frozen. Laundering shows automation, with addresses receiving exactly 1 TRX before forwarding funds.

chainalysis.comarticlePublished and added 30 Oct 2026🛡️ Security

Binance estimated the October 2026 security incident at about $6.3 billion and said it found "additional points of breach" beyond the compromised DevOps engineer laptop it first named. The attacker reached a service container and submitted unauthorized withdrawals, with no wallet private key leak found. Arkham counted $6.01 billion taken from hot wallets on nine chains; Tether and Circle froze about $1.8 billion in stablecoins. About $3 billion is frozen onchain; withdrawals stay suspended.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

Binance linked the theft of about $6.3 billion in crypto to a compromised DevOps engineer's laptop, which let attackers reach a service container and submit unauthorized withdrawals. TRM Labs and Chainalysis attribute the 29 October 2026 attack to North Korea's TraderTraitor. About $2.7 billion was frozen, and the attackers hold about $2.4 billion. Binance has found no evidence of a leaked wallet private key.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

The Binance hack of 29 October 2026 drained about $6.36 billion across ten blockchains in roughly 20 minutes, according to TRM Labs. TRM attributes it with high confidence to North Korea's TraderTraitor, citing a mixer-funded operator wallet, pre-signed transactions and overlap with the Bybit and KelpDAO hacks. Binance's early findings point to a compromised DevOps engineer laptop. Stablecoin issuers froze about $2.7 billion.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Binance disclosed a suspected security incident on 29 October 2026, estimating $6.3 billion affected and about $3 billion frozen. Binance's early finding is that a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals, with no evidence of wallet private-key leakage. TRM Labs suspects TraderTraitor, the group tied to the February 2025 Bybit theft. Tether, Circle and Ripple froze funds.

en.cryptonomist.charticlePublished and added 30 Oct 2026🛡️ Security

Trail of Bits post on X summarising Binance's initial investigation into a security incident. Binance suggests a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawal transactions. The text says no evidence has been found of wallet private key compromise. The fetched text is truncated and gives no further detail.

x.comthreadPublished and added 30 Oct 2026🛡️ Security

Decrypt reports on wallets linked to the suspected Binance hack (at least $5.5 billion drained, 29 October 2026) that swap freezable stablecoins for ETH via Uniswap and borrow 19,762 ETH on Aave. About 253,000 ETH (roughly $570 million) sits idle in two wallets. Tether, Circle and Ripple froze over $2 billion plus about $200 million RLUSD, and Aave and Kamino paused markets. Tornado Cash appears only as funding for the attack address.

decrypt.coarticlePublished and added 29 Oct 2026🛡️ Security

Binance is investigating a possible breach involving up to $5.8 billion in assets, which would exceed the $1.5 billion Bybit theft of February 2025. Tether froze over $1.567 billion in USDT and Circle over $800 million in USDC. Arkham tracks 55 addresses labelled "binance-hacker-1029" holding about $5.78 billion, but that is wallet holdings, not a confirmed theft amount. The cause is not yet known.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

Decrypt reports that at least $5.57 billion left Binance-linked hot wallets on Ethereum, Bitcoin and Tron on 29 October 2026, which would be the largest crypto hack on record. On-chain analysts point to an EIP-7702 delegation, installed from a Tornado Cash-funded address minutes before the first sweep. Tether and Circle froze about $1.8 billion. Binance has not confirmed the hack, and how the attacker obtained the signature is unknown.

decrypt.coarticlePublished and added 29 Oct 2026🛡️ Security

Weekly OpenSourceMalware podcast episode discussing three fresh supply-chain attacks: the Tensorlake AI-agent SDK compromised via a preinstall-triggered Mini Shai-Hulud-derived worm (setup.mjs + math_symbol.js, run via Bun) that steals credentials; a Contagious Interview-style attack where a cloned GitHub repo drops a malicious .npmrc pointing npm install at a Chinese mirror (npmmirror.com) to resolve a hidden package; and 42 malicious RubyGems published by "Ghost Dev" that typosquat/brandjack crypto tooling, sleep 20–40 minutes via extconf.rb to evade detection, then either open a reverse shell or deploy a Python-based "Wallet Guard" crypto-theft kit targeting TronLink, MetaMask, Phantom, Binance, Coinbase, Trust Wallet, Exodus, and Electrum. The hosts also discuss multi-package "combined payload" evasion and how AI-driven slopsquatting is making cross-ecosystem typosquats more effective.

opensourcemalware.comtalkPublished and added 9 Oct 2026🛡️ Security

A daily crypto-market newsletter segment reporting Ethereum Foundation researcher Justin Drake's warning that AI, not quantum computing, may be the first to break ECDSA — the elliptic-curve signature scheme securing Bitcoin and Ethereum — potentially within months by recovering private keys from exposed public keys using large GPU clusters. Drake calls for industry-wide "bunker mode": migrating self-custodied funds to fresh addresses whose public keys remain hashed/hidden, and names exchanges (Binance, Bitbank, Robinhood, Bitfinex, Tether) he wants to harden cold storage. The article also notes a concurrent Europol report flagging crypto wallets with already-revealed public keys as the main weak point for future quantum/AI attacks, since those cannot be retroactively protected.

decrypt.coarticlePublished and added 8 Oct 2026🛡️ Security

Ethereum Foundation researcher Justin Drake warns that AI-driven mathematical advances could break ECDSA — the signature scheme securing Bitcoin and Ethereum — before quantum computers do, potentially recovering a private key from an exposed public key in about a week using a large GPU cluster. He calls for "bunker mode": a controlled mass migration of funds to fresh addresses whose public keys have never been exposed, urges major custodians (Binance, Bitbank, Robinhood, Bitfinex, Tether) to harden cold storage, and pushes Ethereum to accelerate its move to hash-based (post-quantum) cryptography.

decrypt.coarticlePublished and added 7 Oct 2026🛡️ Security

News report on the aftermath of a Rs.13.69 billion internal fraud at Sri Lanka's NDB Bank, based on a Deloitte Touche Tohmatsu India forensic audit. The audit found funds laundered through offshore banking channels and, for a smaller Rs.390 million portion, through a crypto-conversion platform called "Buy Today" using automated sub-accounts on Binance to swap fiat for crypto and move it to secondary wallets, exploiting weak regional compliance controls. The bank is now moving to hire a foreign asset-recovery specialist, likely tied to networks such as ARIN, INTERPOL's Global Focal Point Network, or the Egmont Group.

sundaytimes.lkarticleAdded 4 Oct 2026🛡️ Security

Evaluates vanilla Double Deep Q-Learning (DDQL), K-means-partitioned mixtures of DDQL experts (K=2, 4, 8) and parameter-matched dense networks for order execution on 5-minute BTC/USDT limit order book data from Binance. No learned configuration significantly beats DDQL on implementation shortfall, and all are worse than TWAP and immediate liquidation in this frictionless replay environment. Ablations show annealed exploration alone removes the collapse to wait-until-forced-liquidation policies (12/100 to 0/100), so expert partitioning appears to mask a training-specification flaw rather than add real benefit. The attribution of the failure mode reverses between 30 and 100 seeds, which makes the paper a case for repeated-seed evaluation in RL.

arxiv.orgpaperAdded 15 Oct 2026, published 2 Oct 2026🧠 AI

crypto-rag is an Indonesian-language CLI crypto assistant that pairs a static knowledge-base RAG pipeline with live market data tool calls, built on the principle that volatile numbers (price, funding rate, TVL, sentiment) must never be embedded in the vector store since they go stale instantly. It implements hybrid retrieval (BM25 keyword search + FAISS dense embeddings fused via Reciprocal Rank Fusion) over a 146-topic knowledge corpus, an optional cross-encoder reranker, and an intent router that dispatches price/derivatives/on-chain/sentiment queries to live sources (Binance, DefiLlama, Fear & Greed Index) versus concept questions to the corpus. A tool-calling agent handles multi-step queries, and an OpenAI-compatible LLM synthesis layer (works with StepFun, OpenAI, Groq, LM Studio, Ollama) grounds answers with citations and falls back to extractive answers when no LLM is configured.

github.comrepoAdded 2 Oct 2026, published 5 Sep 2026🧠 AI

PhishDestroy's shortdot-evidence is a daily-updated GitHub investigation into ShortDot SA, the Luxembourg registry operator behind the .icu, .bond, .cyou, .sbs, .cfd, .buzz and .qpon gTLDs, documenting that 51,985+ tracked domains impersonate brands like Chase, Binance, MetaMask and Ledger and that ~70% of registered domains in these zones carry no DNS records (metric-padding rather than legitimate use). It publishes machine-generated IOC/blocklist files and analytics built from a per-TLD zone-file pull cross-referenced against Spamhaus DBL, SURBL, OpenPhish, URLhaus, PhishTank and AlienVault OTX, and ties the zones to concrete criminal cases (FBI's LabHost domain list, Google v. DOES/Yucheng Chang RICO suits, the Revolver Rabbit XLoader/Formbook C2 campaign using 500k+ .bond domains). It also details structural conflicts of interest between ShortDot, its registry infrastructure provider Team Internet Group/CentralNic, registrar partner NameSilo, and the brand-protection vendor NameBlock, backed by Interisle Consulting Group phishing-volume statistics.

github.comrepoPublished and added 25 Jul 2026🛡️ Security

THORChain's second exploit post-mortem details how an attacker who joined as a validator planted a malformed multi-prime Paillier modulus during GG20 threshold-signature key generation, then deliberately failed 864 MTA signing rounds over 2.5 days to leak fragments of other validators' key shares via a combination of three individually low-severity flaws inherited from Binance's tss-lib: an unverified Paillier modulus (the same class documented as BitForge and TSSHOCK), a range proof that didn't bind its two halves together, and an undersized blinding value. Once enough fragments accumulated the attacker reconstructed the full vault private key and drained roughly 10 million dollars in a single transaction before solvency checks could react, since no anomalous fund movement preceded the theft. THORChain is patching the fork, moving from GG20 and Paillier to DKLS and Schnorr based signing, and adding per-validator key-sign failure monitoring as a result.

blog.thorchain.orgwriteupAdded 29 Sep 2026, published 3 Jul 2026🛡️ Security