FBI attributes record ~$6.3B Binance crypto heist to North Korea's TraderTraitor; Binance resumes phased withdrawals

Linha do tempo

1. malwarebytes.com ↗ · pub. 30/10/2026 09:24 · coletado 01/11 22:21

   Binance loses ~$6.3B in record crypto theft; TraderTraitor linked, DevOps laptop suspected as entry point

   ler a análise desta fonte ocultar

   Binance disclosed a security incident affecting roughly $6.3 billion in cryptocurrency, described as the largest crypto theft ever. Its initial investigation points to a compromised DevOps engineer's laptop used to reach a service container and submit unauthorized withdrawals. TRM Labs and Chainalysis attribute the theft to TraderTraitor, a North Korean group tied to earlier crypto heists. Binance says about $3 billion has been frozen and it will cover all losses from its emergency fund and company funds. Binance.US was not affected.

   Technical Details

   • Binance reported no evidence of a wallet private key leak (update of October 30).
   • Co-CEO Richard Teng told BleepingComputer the attacker did not simply use one engineer's permissions; the attack involved a more complex process, and investigators found additional breach points.
   • TRM Labs estimates about $6.36 billion left Binance wallets across ten blockchains, most within about 20 minutes.
   • Frozen and stolen totals from analysts differ and remain developing estimates.

   Remediation

   • Use only official Binance channels (app or support site you open yourself); ignore unexpected messages urging urgent verification or compensation claims.
   • Review transaction history and security settings; contact official support to disable an account or reset password or 2FA if activity looks unfamiliar.
   • Never share authentication codes.
   • Be wary of fake crypto recovery services (FBI warning, 2023).
   • Preserve evidence (messages, wallet addresses, transaction details) if you lose money to a related scam.
2. hackread.com ↗ · pub. 30/10/2026 08:54 · coletado 01/11 22:21

   Binance probes compromised DevOps laptop after $6.3B theft attributed to North Korea's TraderTraitor

   ler a análise desta fonte ocultar

   Binance says its investigation into a roughly $6.3 billion cryptocurrency theft found a compromised DevOps engineer's laptop that let an attacker reach a service container and submit unauthorized withdrawals. Blockchain intelligence firms TRM Labs and Chainalysis attribute the theft to the North Korean group TraderTraitor (linked to Lazarus Group). Binance has stated that the laptop is only an initial finding and that additional breach points exist. Withdrawals remain paused while deposits continue, and the exchange has promised to cover all losses via its SAFU fund.

   Technical Details

   • Binance found no evidence that wallet private keys leaked; it revoked the affected address authorization. This leaves open that attackers abused internal access to obtain valid signatures.
   • TRM Labs calculated about $6.36B left Binance wallets across ten networks, mostly within about 20 minutes starting 20:05 GMT on October 29.
   • Preparation began at least 36 hours earlier, including funding through Tornado Cash and tests of attack code.
   • Valid transactions across many networks pointed to compromised hot-wallet signing infrastructure.
   • On Ethereum, the attacker used EIP-7702 authorizations to make a Binance wallet execute attacker-controlled code and repeatedly forward incoming funds.
   • TRM compared preparation and signing patterns to earlier DPRK thefts including Bybit ($1.5B, Feb 2025). The article notes the tactic resembles North Korean use of Ethereum-based dead drops in malicious npm packages seen in August 2026.
   • Binance has not named the attackers; attribution is from TRM (high confidence) and Chainalysis (likely).
   • About $3B in assets has been frozen by industry partners.

   Remediation

   • Binance is revamping the withdrawal service and related addresses and expects to resume withdrawals within about 45 hours of its update.
   • A technical post-mortem and an updated Proof of Reserves are promised.
   • Malwarebytes' Pieter Arntz cautions against treating the laptop as the full cause; the question is why safeguards failed to stop unauthorized transactions.
3. hackread.com ↗ · pub. 01/11/2026 08:11 · coletado 01/11 22:21

   FBI Attributes $6.3B Binance Theft to North Korea's TraderTraitor, Publishes 628 Crypto Wallet Addresses

   ler a análise desta fonte ocultar

   The FBI has attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea, naming the activity TraderTraitor. In an October 31 announcement, the bureau said the theft occurred on or around October 29, 2026, and published 628 addresses tied to the stolen funds. Binance estimates the loss at about $6.3 billion, with roughly $3 billion verified as frozen. The FBI, US Secret Service and IRS Criminal Investigation are asking crypto businesses to block transactions involving the listed addresses.

   Technical Details

   • Binance's first detailed explanation: a compromised DevOps engineer's laptop appeared to let the attacker reach a service container and submit unauthorised withdrawal transactions. Binance found no evidence of wallet private key leakage.
   • Binance later identified additional breach points without explaining them publicly. It promised to cover all losses and to publish a technical report after its investigation.
   • The FBI alert lists 608 Ethereum, 19 Bitcoin and 1 Solana addresses that hold or previously held stolen assets and are operated by or closely tied to TraderTraitor.
   • Investigators have seen the attackers converting stolen assets mainly into Ethereum and expect further laundering via DeFi platforms and instant swap services.
   • The FBI announcement does not explain how the laptop was compromised or give a full account of the attack.

   Remediation

   • THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other VASPs are asked to block transactions involving the listed addresses and funds derived from them.
   • Anyone with information should contact an FBI field office or file a report with the Internet Crime Complaint Center (IC3).
4. helpnetsecurity.com ↗ · pub. 30/10/2026 05:26 · coletado 01/11 22:21

   Binance hit by ~$6.3B crypto theft via compromised DevOps laptop; TRM and Chainalysis link it to North Korea's TraderTraitor

   ler a análise desta fonte ocultar

   About $6.3 billion in cryptocurrency was stolen from Binance, which would make it the largest crypto heist on record. Binance's initial investigation points to a compromised DevOps engineer's laptop that let the attacker reach a service container and submit unauthorized withdrawals, though a later update said additional breaches went beyond the laptop. TRM Labs and Chainalysis attribute the attack, with high confidence and likely respectively, to the North Korean group TraderTraitor. Binance says it will cover all losses from the SAFU fund and company funds, and user funds are safe.

   Technical Details

   • Binance found no evidence of a wallet private key leak. It is tracing the attack path through the compromised laptop and has said the attacker did not simply use one engineer's permissions.
   • TRM counts about $6.36B leaving Binance wallets across ten blockchains. Wallets with different key types and signing schemes all produced valid signatures within about 30 minutes, which TRM says indicates a compromise of Binance's hot wallet signing infrastructure.
   • On Ethereum, attackers took control of a hot wallet using 50 pre-signed authorizations, and TRM's early indicators suggested they had been phished. Phishing would not explain the activity on the other chains.
   • Tether froze more than 1.567B USDT and Circle froze more than 800M USDC. Freezes by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council reached about $2.7B, and Binance cites close to $3B frozen on-chain.
   • Attackers still hold more than 420,000 ETH and 18,270 BTC (about $2.4B). TRM expects them to move through cross-chain bridges, swap services and OTC brokers.

   Remediation

   • Binance revoked the affected address authorization and is revamping the withdrawal service and its related addresses. Withdrawals are expected to resume within 48 hours, and an updated Proof of Reserves and a technical post-mortem are promised.
   • TRM advises exchanges to screen deposits against the addresses it has tied to the theft.
5. securityaffairs.com ↗ · pub. 01/11/2026 16:23 · coletado 01/11 17:00

   FBI attributes $6B Binance crypto theft to North Korea's TraderTraitor (Lazarus/APT38)

   ler a análise desta fonte ocultar

   The FBI has attributed the theft of more than $6 billion in virtual assets from the Binance exchange, on or about October 29, 2026, to North Korea's TraderTraitor cluster, also tracked as Lazarus Group and APT38. TRM was first to attribute the attack to TraderTraitor and Chainalysis also expressed high confidence, while Binance has not named a culprit. TRM says about $6.36 billion left Binance wallets on ten blockchains, mostly within about 20 minutes from 20:05 UTC, making this the largest crypto theft on record, roughly four times the Bybit hack of February 2025. The FBI, USSS and IRS-CI are asking crypto service providers to block transactions tied to the actor's wallet addresses as the funds are laundered.

   Technical Details

   • Attackers used access from an engineer's laptop to reach a service container and send unauthorized withdrawal requests. Binance says it found no evidence that wallet private keys were stolen.
   • The agencies observed the actors converting stolen assets primarily into Ethereum (ETH), with further laundering expected through DeFi and instant swap services.
   • Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB (roughly $2.7 billion in all). Early reports put the Tether and Circle freezes at about $1.79 billion; the figures describe different moments and should not be summed blindly.
   • The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach.

   Remediation

   • THORNode operators, RPC node operators, instant exchanges, DeFi platforms, blockchain analytics firms and other crypto service providers should block transactions involving the TraderTraitor wallet addresses listed in the FBI alert, including funds derived from them.
   • Check blocklists against the FBI list and review transaction flows that touch those addresses indirectly.
   • Information can be reported to a local FBI field office or ic3.gov.
6. bleepingcomputer.com ↗ · pub. 01/11/2026 16:57 · coletado 01/11 17:00

   FBI attributes $6.3B Binance crypto heist to North Korea's TraderTraitor (Lazarus)

   ler a análise desta fonte ocultar

   The FBI has formally attributed the theft of roughly $6.3-6.36 billion in virtual assets from Binance, on or about October 29, 2026, to North Korea's TraderTraitor (also tracked as Lazarus Group, Jade Sleet and APT38). It is the largest cryptocurrency heist on record. The attribution follows earlier links made by TRM Labs and Chainalysis. Binance previously tied the breach to a compromised DevOps engineer's laptop, which gave the attackers access to a service container from which they submitted unauthorized withdrawals across ten blockchains, mostly within 20 minutes. Binance says it has covered about 95% of the impacted amount and plans to resume the first phase of withdrawals on November 1.

   Technical Details

   • The attackers used the compromised DevOps laptop to reach a service container and submit unauthorized withdrawal transactions, per Binance.
   • The FBI observed TraderTraitor converting stolen assets mainly into Ethereum (ETH) and expects further laundering through DeFi platforms and instant swap services.
   • The FBI published 628 associated addresses: 608 Ethereum, 19 Bitcoin and 1 Solana.
   • Prior TraderTraitor thefts cited: Bitget ($387.5M, Sep 2026), Drift ($280M, Apr 2026), Bybit ($1.5B, Feb 2025) and DMM Bitcoin ($308M, May 2024). These involved developer or employee compromise through fake recruiter approaches (Operation DreamJob), malicious Python code disguised as a pre-employment test, a compromised Safe{Wallet} developer machine, and a six-month in-person social engineering campaign against Drift contributors.

   Remediation

   • The FBI, U.S. Secret Service and IRS Criminal Investigation ask exchanges, blockchain operators and other virtual asset service providers to block transactions linked to the published addresses.
   • Defenders at crypto firms should harden developer and DevOps endpoints and train staff on fake-recruiter and conference-based social engineering.
   • Binance states it will bear the losses, that users will not, and that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed.
7. techcrunch.com ↗ · pub. 01/11/2026 13:20 · coletado 01/11 15:00

   Binance resumes phased withdrawals after $6.3B theft attributed by FBI to North Korea's TraderTraitor

   ler a análise desta fonte ocultar

   Binance announced on 1 November 2026 that it is resuming withdrawals in phases, after freezing deposits and withdrawals following the theft of $6.3 billion in crypto from its wallets. The exchange says it has covered 95% of the stolen assets and is still sourcing the remaining, less liquid ones. It also states that it will absorb the losses and not pass them on to users. On 31 October the FBI attributed the breach to the North Korean group TraderTraitor, which is converting the proceeds mainly into Ethereum, with further laundering expected. Binance had earlier blamed North Korean hackers and plans to publish a detailed incident report once its investigation is complete.

   Technical Details

   • The article does not describe the intrusion vector or the technical method of compromise.
   • The FBI says TraderTraitor is converting the stolen assets primarily into Ethereum and that further laundering is likely.
   • Network status on 1 November showed mixed states: Bitcoin withdrawals and deposits partially suspended, Ethereum deposits normal and withdrawals partially suspended.
   • Users should expect delays and longer processing times due to traffic volume.

   Remediation

   • Binance froze deposits and withdrawals to contain losses, assess impact, restore services and complete security checks.
   • It is restoring withdrawals in phases by network and asset type, and says it is strengthening safeguards and completing recovery.
   • A full incident report is promised after the investigation ends.
8. olhardigital.com.br ↗ · pub. 01/11/2026 09:46 · coletado 01/11 11:01

   FBI attributes $6.3B Binance theft to North Korea's TraderTraitor after compromise of an engineer's laptop

   ler a análise desta fonte ocultar

   The FBI has formally attributed to North Korea the theft of about US$ 6.3 billion in digital assets from Binance, the world's largest cryptocurrency exchange, carried out around 29 October. The FBI says the operation was conducted by TraderTraitor, a state-sponsored group that CISA describes as part of Lazarus Group. The attackers were seen converting part of the loot into Ether, and the FBI expects laundering through DeFi platforms and instant swap services. It asked industry firms to block transactions tied to the group's addresses. Binance says it has covered 95% of the stolen assets with its own funds, and about US$ 3 billion has been located with partners. Withdrawals began resuming on 1 November.

   Technical Details

   • Binance co-CEO Richard Teng described a complex attack involving several vulnerabilities.
   • Initial findings suggest a compromised laptop belonging to a company engineer served as the entry point, giving access to an internal system used to authorize unauthorized withdrawals.
   • The attackers reportedly used malware designed to erase evidence of their activity, hampering tracing and investigation.
   • Most funds were drained in about 20 minutes on the night of 29 October.
   • TraderTraitor has been active since at least 2020 and uses spear phishing and malware distribution. It was also linked to the roughly US$ 1.5 billion Bybit theft in February 2025.
   • Private blockchain analytics firms had pointed to North Korean involvement before the FBI statement.

   Remediation

   • Crypto industry firms are asked by the FBI to block transactions related to the digital addresses used by the group.
   • Binance suspended deposits and withdrawals, worked with partners to freeze assets, and replenished funds from SAFU, its futures insurance fund and corporate cash.
9. thehackernews.com ↗ · pub. 01/11/2026 03:44 · coletado 01/11 05:00

   FBI attributes record $6.43B Binance crypto heist to North Korea's TraderTraitor (Jade Sleet)

   ler a análise desta fonte ocultar

   The FBI, together with the U.S. Secret Service and IRS-CI, has attributed the theft of more than $6 billion in virtual assets, reported as a $6.43 billion Binance heist, to TraderTraitor (also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899), a North Korea-aligned group. It is the largest cryptocurrency theft on record, surpassing the $1.46 billion Bybit theft of February 2025. The funds were taken across 11 blockchains, 82% of them on Ethereum and Bitcoin, and the actor is converting them primarily into ETH ahead of further laundering through DeFi and instant swap services. Of the total, $2.85 billion has been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. Binance has resumed phase one of withdrawals, and deposits were not affected.

   Technical Details

   • The article does not state how Binance was compromised. It describes TraderTraitor's recent tradecraft as reported by SentinelOne, Zscaler ThreatLabz and Microsoft.
   • Trojanized Terraform providers deliver a Bash loader that selects and downloads malware matching the victim's OS (macOS, Linux, Windows). This includes the cross-platform implant FLATROOF, which uses a Python-based information stealer and finally drops the ROOFDECK backdoor for full remote control.
   • Recruitment-themed social engineering uses front companies, tailored domains and social media profiles to pose as recruiters for a spoofed AI-powered blockchain intelligence company, targeting people in cybersecurity, AI, blockchain and talent recruitment. AI is used to craft lures and fake personas and to evade detection.
   • The group has been active since at least 2020 and has been linked to the DMM Bitcoin, Bybit, KelpDAO and Bitget thefts.
   • The FBI published a list of wallet addresses used for laundering; the article does not reproduce them.
   • Elliptic estimates DPRK-linked actors have stolen over $6.5 billion in cryptoassets in recent years.

   Remediation

   • The article gives no explicit remediation. Defenders can use the FBI-published wallet list for blocking and monitoring, and should treat unsolicited job-themed outreach and third-party Terraform providers as untrusted.
10. olhardigital.com.br ↗ · pub. 30/10/2026 20:37 · coletado 30/10 21:00

    Binance hot wallets drained of about US$6.3B; TRM Labs and Chainalysis point to North Korea's TraderTraitor, US investigating

    ler a análise desta fonte ocultar

    A cyberattack drained roughly US$6.3 billion in cryptocurrency from hot wallets used by Binance to process transactions, most of it in about 20 minutes from late 29 October 2026. TRM Labs attributed the theft to TraderTraitor, a North Korea-linked unit, with high confidence, and Chainalysis shared that conclusion. Binance has not confirmed the attribution. President Donald Trump said on 30 October that the US government is looking into possible North Korean involvement. The FBI is aware of the incident and Binance is also working with the US Secret Service (per Reuters). Binance says it has set aside about US$6.34 billion of its own funds to cover losses, and that no customer funds were used.

    Technical Details

    • Binance's initial investigation suggests the intrusion may have started with the compromise of a Binance engineer's computer. Other possible entry points were identified later.
    • Co-CEO Richard Teng described the attack as complex. It involved manipulating a system that approves transactions, which let the attackers move funds from an internet-connected wallet without the usual authorization controls.
    • Binance reported that the attackers used software to erase traces and evidence of their activity, which hampers the investigation.
    • The affected assets were hot wallets, which are more exposed than offline cold wallets.
    • Blockchain analytics firms say the incident resembles the Bybit theft of about US$1.5 billion in February 2025, which the FBI attributed to North Korea and TraderTraitor.
    • North Korea routinely denies involvement in cyberattacks. Its representatives in Switzerland and China did not respond to Reuters.

    Remediation

    • Binance temporarily suspended withdrawals and said it expected to resume them within 48 hours.
    • Binance has traced about US$3 billion of the stolen funds with partners. Tether froze about US$1.57 billion and Circle blocked more than US$800 million.
    • The destination of the remaining roughly US$3.3 billion had not been clarified.
    • Market impact: Bitcoin fell to US$76,368, a six-week low, and Ether dropped more than 3% to US$2,178.
11. securityaffairs.com ↗ · pub. 30/10/2026 15:50 · coletado 30/10 17:00

    Binance loses about $6.3B in record crypto theft via compromised DevOps laptop; TRM and Chainalysis attribute it to DPRK's TraderTraitor

    ler a análise desta fonte ocultar

    Binance confirmed a security incident on October 29, 2026, in which an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, mostly within about 20 minutes starting at 20:05 UTC. This is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. Binance Co-CEO Richard Teng said the incident may have started with a compromised DevOps engineer's laptop, which gave the attacker access to a service container used to submit unauthorized withdrawals. Binance has not named a culprit, but TRM attributes the attack to TraderTraitor (also tracked as Lazarus Group and APT38) with high confidence, and Chainalysis also reports a high degree of confidence in DPRK responsibility. Binance says user funds are safe and that it will cover all losses with its SAFU fund and its own money.

    Technical Details

    • Per Binance, the attacker used access from the engineer's laptop to reach a service container and submit unauthorized withdrawal transactions. Teng stressed this was not a single "one-click" action but a more complex attack process, and that the attacker did not simply use one engineer's permissions.
    • Binance reports no evidence that wallet private keys were stolen. It also said it found "additional points of breach" and is still investigating.
    • Early on-chain estimates varied. Analyst Spreek flagged about $3.55B in incoming transfers to one unlabeled wallet, and Coinbase's Conor Grogan estimated up to $5.8B. These were tracking figures and not confirmed theft totals.
    • Chainalysis observed funds stolen by DPRK in the previous month's Bitget exploit commingling with the funds stolen from Binance.
    • Freezes recovered only part of the funds. Tether, Circle, Ripple and World Liberty Financial froze about $2.67B in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6M ARB, for roughly $2.7B in all. Early reports put the Tether and Circle freezes at about $1.79B, and these figures describe different moments and should not be added together.
    • The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4B beyond any issuer's reach.

    Remediation

    • Binance suspended deposits and withdrawals for security checks, revoked the permissions tied to the affected address, and is working with blockchain analysis firms and law enforcement. It plans to publish an updated Proof of Reserves after recovery.
    • Customers should use only official Binance channels, avoid unsolicited links, and never share passwords, authentication codes or recovery phrases. Security teams should watch for phishing that exploits the incident.
12. aikido.dev ↗ · pub. 30/10/2026 10:13 · coletado 30/10 12:01

    Binance $6.3B theft traced to compromised DevOps engineer laptop, additional breach points found

    ler a análise desta fonte ocultar

    Binance reports a roughly $6.3 billion incident that its initial findings link to a compromised DevOps engineer's laptop, which allegedly gave an attacker access to a service container able to submit unauthorized withdrawal transactions. A later investigation update said further work uncovered additional points of breach beyond the laptop, without detail. Binance says about $3 billion has been frozen on-chain, that it will cover all losses, and that it has so far found no evidence of a wallet private key leak. Co-CEO Richard Teng stated the attack went beyond one engineer's permissions and more than a single click. TRM Labs and Chainalysis attribute the incident to TraderTraitor, a North Korean unit; Binance has not confirmed the attribution.

    Technical Details

    The article, from Aikido, describes the plausible chain rather than confirmed Binance forensics: malicious code on a developer device harvests cloud credentials, SSH and git keys, Kubernetes configs and live session tokens that bypass MFA, then the attacker pivots to internal build servers or cloud accounts and finally to a service authorized to submit withdrawals. Because signing keys typically sit in a vault or HSM and an approval service requests signatures, funds can move without key theft — a view also voiced by Blockaid's CEO (compromise of signing infrastructure). Aikido notes it blocked nearly 500 malware attacks on developer devices in one week, and cites North Korean developer-targeting techniques: fake job interviews with take-home coding tests, malicious npm install scripts, and malicious IDE extensions. Prior examples cited include the npm package react-html2pdf.js (March 2025, attributed to Lazarus Group), the PolinRider campaign hiding obfuscated code in project config files that runs on opening a project in VS Code and rewrites repository history, and the 2025 Bybit theft where a developer laptop was compromised on Feb 4 and a stolen AWS session token enabled malicious code injection on Feb 17 leading to the Feb 21 theft (per Safe findings reported by heise).

    Remediation

    • Deploy endpoint controls that block malicious packages, editor extensions and AI tools before installation; quarantine packages published in the last 48 hours.
    • Keep long-lived credentials off developer disks; issue short-lived, hours-scoped credentials.
    • Require out-of-band approval for high-value actions such as withdrawals so a compromised service cannot self-approve.
    • Alert on credential and session use from anomalous locations or times.
    • Bring contractor and personal machines that reach production under company management.
13. itsecurityguru.org ↗ · pub. 30/10/2026 11:48 · coletado 30/10 12:00

    Binance loses $6.3bn in record crypto heist; TRM Labs attributes to DPRK's TraderTraitor via compromised DevOps laptop

    ler a análise desta fonte ocultar

    Binance confirmed the theft of approximately $6.3 billion in digital assets beginning around 20:05 UTC on 29 October 2026, making it the largest cryptocurrency theft on record — roughly four times the $1.5bn Bybit hack of February 2025. According to TRM Labs, funds drained across ten blockchains including Ethereum, Bitcoin, Tron, XRP Ledger and Solana, with most moved inside 20 minutes. Binance's preliminary findings point to a compromised DevOps engineer's laptop that gave attackers access to a service container able to submit withdrawals; the exchange says there is no evidence of private key leakage but has acknowledged additional points of breach. Around $3 billion was frozen within hours with help from Tether and Circle (over $2.5bn in USDT/USDC), partners and law enforcement, while TRM estimates the attacker still controls over $2.4 billion in ETH and BTC being laundered via Uniswap, Aave and JustLend. TRM attributes the attack "with high confidence" to TraderTraitor, a North Korean state-backed unit linked to Lazarus Group; independent investigator ZachXBT concurs. Bitcoin fell ~5% below $77,000 and BNB dropped ~8%.

    Technical Details

    • Initial access: compromise of a DevOps engineer's endpoint, pivoting to a service container authorised to submit withdrawals — control of the signing/authorisation layer rather than theft of private keys.
    • On Ethereum, the attacker abused EIP-7702 authorisations to make a Binance hot wallet execute an attacker-controlled sweeper contract; the other nine chains saw ordinary signed transfers in the same window.
    • TRM assesses Binance's hot wallet signing infrastructure was likely compromised; no root cause has been published.
    • Pre-attack staging included small Tornado Cash withdrawals funding an operator wallet the day before, plus pre-obtained signatures matching prior DPRK-linked heists.
    • Analysts link the incident to a pattern including Bitget's ~$388m loss in September 2026, also attributed to North Korea and also described as "keys untouched, control layer abused".

    Remediation

    • Treat developer and admin devices as high-value targets; assume any machine or credential is compromised.
    • Enforce independent approval for large transfers; set hard velocity and value limits on fund movement and detect anomalies in seconds.
    • Deploy phishing-resistant MFA, just-in-time privileged access, tightly scoped and monitored human and non-human identities.
    • Inventory exactly which machines and accounts can trigger a transfer, and test whether compensating controls hold when one is compromised.
    • Apply cryptographic separation between systems and tightly controlled paths for sensitive transactions so one foothold does not inherit authority over all assets.
14. techcrunch.com ↗ · pub. 30/10/2026 11:00 · coletado 30/10 12:00

    North Korea's TraderTraitor blamed for record $6.3B crypto theft from Binance via compromised engineer laptop

    ler a análise desta fonte ocultar

    Binance, the world's largest crypto exchange, suffered the largest known cryptocurrency theft in history, with at least $6.3 billion drained from its wallets. Binance stated its initial investigation traced the intrusion to a compromised engineer's laptop, which allowed the attacker to access a service container and submit unauthorized withdrawal transactions. The exchange said there is no evidence its private keys were leaked, and it has suspended all deposits and withdrawals pending investigation. TRM Labs and Elliptic both attributed the heist to North Korean state-linked hackers tracked as TraderTraitor, the same cell blamed for the $1.4B Bybit hack in 2025. Roughly $3 billion has been frozen by industry partners, according to Binance spokesperson Andie Cooper.

    Technical Details

    • Initial access: compromise of a Binance engineer's laptop; the circumstances remain unclear, with TechCrunch noting compromised software/open-source components and malware-bundled apps stealing credentials and session tokens as common vectors.
    • Lateral movement into a service container with authority to submit withdrawal transactions.
    • TRM Labs reports the drain took roughly 20 minutes and calls it the "largest hack in history."
    • Elliptic says some stolen funds landed in the same wallet used in the $351 million Bitget theft earlier this year, reinforcing attribution.

    Remediation

    • Binance suspended all deposits and withdrawals and says it has begun recovering affected assets, working with law enforcement, token issuers and blockchain intelligence firms to trace and freeze funds.
    • Binance pledged to publish an updated proof of reserves once remediation completes; it has not yet provided proof that user funds are safe.
    • Defenders should review segregation between employee endpoints and production signing/withdrawal infrastructure, enforce multi-party approval for high-value transactions, and monitor developer workstations for infostealer and supply-chain compromise.
15. olhardigital.com.br ↗ · pub. 30/10/2026 08:20 · coletado 30/10 10:01

    Binance loses $6.3B in largest crypto exchange hack ever; TRM Labs links theft to North Korean actors

    ler a análise desta fonte ocultar

    Hackers stole approximately $6.3 billion from Binance, the world's largest cryptocurrency exchange, in what analysts describe as the largest theft in the sector's history. According to TRM Labs, the attackers drained Binance wallets across 10 different blockchains, moving most of the funds in roughly 20 minutes, and the firm attributed the operation to North Korean groups based on technical similarities with prior thefts including the 2025 Bybit hack. Chainalysis could not yet confirm the root cause but had traced at least $5.912 billion in stolen assets. Binance's preliminary investigation indicates the intrusion may have begun with the compromise of an engineer's computer, granting the attacker access to an internal system used to perform unauthorized withdrawals. Binance says user deposits were unaffected, withdrawals were expected to resume within 48 hours, and co-founder Yi He stated the company will cover all losses.

    Technical Details

    • Wallets drained across 10 blockchains, with the bulk of funds moved in ~20 minutes.
    • Initial access hypothesis: compromise of an engineer's workstation leading to access to a Binance internal system (T1078, T1199 style trusted-access abuse).
    • Mark Karpeles (ex-Mt. Gox) suggested the attacker may have obtained valid authorization to move funds and possibly access to a private key.
    • Attribution to DPRK-linked actors by TRM Labs, echoing the FBI's attribution of the 2025 Bybit theft.

    Remediation

    • Binance worked with partners to freeze roughly $3 billion: Tether froze ~$1.57B, Circle blocked >$800M, Ripple froze ~$200M, and World Liberty Financial with custodian BitGo froze $27M in stablecoins and ~$2M in its tokens.
    • Binance maintains a Bitcoin-denominated customer protection fund (SAFU-style) to absorb losses.
    • Market impact: Bitcoin fell >3% to a six-week low of $76,368, Ether fell >3% to $2,178, Coinbase shares dropped 4.8% and Strategy nearly 6%.
16. wired.com ↗ · pub. 30/10/2026 08:36 · coletado 30/10 10:01

    $6.3B Binance hot wallet heist executed in 20 minutes, tracing firms point to North Korea's TraderTraitor

    ler a análise desta fonte ocultar

    Binance lost roughly $6.3 billion in cryptocurrency on October 29, 2026, with the bulk drained in about 20 minutes from hot wallets spanning at least ten blockchains including Ethereum, Bitcoin, Tron and Solana. Binance suspended deposits and withdrawals, pledged to cover all losses, and said its investigation initially pointed to a compromised engineer's laptop but has since uncovered "additional points of breach." Tracing firms TRM Labs, Chainalysis and Elliptic assess North Korean involvement, with TRM and Chainalysis specifically linking the operation to TraderTraitor, the group the FBI blamed for the $1.5 billion Bybit heist. Chainalysis investigators observed stolen funds commingling in real time with proceeds of the earlier Bitget exploit attributed to DPRK actors. Around $2.8 billion (44%), almost all stablecoins, has been frozen; the remaining ~$3.3 billion in Bitcoin, Ether and XRP cannot be frozen.

    Technical Details

    • Preparation began at least 36 hours before the theft (TRM Labs). The operator funded a wallet via Tornado Cash and received three small test withdrawals.
    • Early on October 29 the attacker deployed a first version of the attack code and tested it on two wallets, then rehearsed the final version on a third wallet and routed test funds back to itself.
    • Four hours after the rehearsal the same code was installed on a Binance hot wallet, draining funds to multiple addresses controlled by a single attacker.
    • Chainalysis reports laundering patterns not previously seen, with thousands of rapid transactions indicating automation used to obscure the fund trail.
    • Targeting crypto staff with social engineering and bespoke fake applications is described as a TraderTraitor hallmark (Elliptic, Sophos).

    Remediation

    Crypto exchanges and custodians should coordinate freezing of flagged stablecoin addresses, monitor for inbound laundered funds, and harden developer and engineer endpoints against laptop compromise, including strict separation between workstation access and hot wallet signing infrastructure.

17. infosecurity-magazine.com ↗ · pub. 30/10/2026 08:25 · coletado 30/10 10:01

    Binance confirms record $6.3bn crypto theft attributed to North Korea's TraderTraitor

    ler a análise desta fonte ocultar

    Binance has confirmed the largest cryptocurrency heist on record, with $6.3bn in crypto stolen. In an October 30 statement, the exchange said the likely entry point was a compromised DevOps engineer's laptop, which gave the attacker access to a service container and allowed submission of unauthorized withdrawal transactions; subsequent investigation uncovered additional points of breach. Binance says it has frozen $3bn of the stolen funds and will cover all losses via its SAFU fund and company funds, and found no evidence that wallet private keys were leaked. TRM Labs, Elliptic and Chainalysis attribute the attack with high confidence to TraderTraitor, a North Korean threat group. Withdrawals remain suspended pending a security revamp, with resumption expected within 45 hours; deposits have resumed.

    Technical Details

    • Initial access suspected via a compromised DevOps engineer endpoint, pivoting to a service container used to sign/submit withdrawal transactions.
    • Binance states multiple breach points were later identified and describes the intrusion as a complex attack; a full technical post-mortem is pending.
    • Unauthorized outflows stopped once withdrawals were paused; the affected address authorization was revoked.

    Remediation

    • Temporary suspension of withdrawals and Binance Alpha trading activities; deposits restored.
    • Security revamp of the withdrawal service and related addresses, updated proof of reserves to follow.
    • Users warned of scams and phishing exploiting the incident: trust only official Binance channels and never share account information.
18. digit.fyi ↗ · pub. 30/10/2026 08:16 · coletado 30/10 10:00

    Binance reports $6.3B crypto theft attributed to North Korea's TraderTraitor

    ler a análise desta fonte ocultar

    Binance disclosed a cyberattack affecting approximately $6.3 billion in digital assets, potentially the largest cryptocurrency hack on record. The exchange says roughly half the affected assets have been frozen with help from other platforms and pledged to cover all losses. Initial investigation points to a compromised laptop belonging to a Binance engineer as the entry point, enabling unauthorised withdrawals. Blockchain analytics firms TRM Labs and Chainalysis both attribute the intrusion to TraderTraitor, a North Korean group also linked to the 2025 Bybit hack ($1.5bn). Binance has not confirmed the DPRK attribution and says it is cooperating with law enforcement; Binance.US is unaffected.

    Technical Details

    • Suspected initial access via an engineer's compromised endpoint, consistent with TraderTraitor's history of social engineering and developer/employee targeting.
    • Attack elements resemble prior DPRK-linked exchange intrusions, notably Bybit (2025).
    • The attacker reportedly still controls a substantial portion of the stolen assets; tracing and recovery are ongoing.

    Remediation

    • Exchanges should harden privileged engineer workstations, enforce hardware-backed MFA, segment signing infrastructure and apply multi-party approval for withdrawals.
    • Monitor for anomalous withdrawal flows and coordinate with analytics providers for asset freezing.
19. bleepingcomputer.com ↗ · pub. 30/10/2026 06:18 · coletado 30/10 07:00

    Binance traces record $6.3B crypto theft to compromised DevOps engineer laptop; TraderTraitor blamed

    ler a análise desta fonte ocultar

    Binance has attributed the theft of roughly $6.3 billion in cryptocurrency to a compromised DevOps engineer's laptop, which attackers used to reach a service container and submit unauthorized withdrawal transactions. Co-CEO Richard Teng stressed the intrusion was not a single "one-click" action and that no leaked wallet private key has been found; the company says it "uncovered additional points of breach" and is still investigating. Blockchain intelligence firms TRM Labs and Chainalysis attribute the attack with high confidence to TraderTraitor, the North Korean state-backed unit also tracked as Lazarus Group and APT38. Roughly $2.7 billion has been frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council, but about $2.4 billion in ETH and BTC remains beyond issuer control. At $6.36 billion, this surpasses the February 2025 Bybit hack as the largest crypto theft on record.

    Technical Details

    Access to a DevOps engineer's endpoint enabled lateral movement into a service container from which unauthorized withdrawals were submitted. On 29 October 2026, approximately USD 6.36 billion moved out of Binance wallets across ten blockchains, most of it within about 20 minutes starting at 20:05 UTC. The attacker outran freezing actions by selling USDT to market makers and borrowing ETH against USDT on Aave, ending with over 420,000 ETH and 18,270 BTC.

    Remediation

    Binance suspended deposits and withdrawals pending security checks, revoked authorizations for the affected address, and is working with blockchain intelligence partners and law enforcement on tracing and recovery. Losses will be covered by the SAFU fund and company funds, with an updated Proof of Reserves to be published after remediation.

20. securityweek.com ↗ · pub. 30/10/2026 05:16 · coletado 30/10 06:00

    $6.3 Billion Binance Heist Attributed to North Korea's TraderTraitor After DevOps Laptop Compromise

    ler a análise desta fonte ocultar

    Binance suffered the largest crypto theft ever recorded, losing roughly $6.3 billion (TRM Labs counts $6.36B) across ten blockchains on October 29, 2026, with most funds moved within about 20 minutes. Binance's initial investigation points to a compromised DevOps engineer's laptop that gave the attacker access to a service container capable of submitting unauthorized withdrawal transactions; no wallet private key leak was found. TRM Labs attributes the attack with high confidence to TraderTraitor, North Korea's elite hacking unit, citing overlaps with the Bybit ($1.5B, Feb 2025) and KelpDAO (April 2026) heists. Chainalysis concurs, noting proceeds from the Bitget exploit mixed with Binance funds, and ZachXBT points to Lazarus Group. Roughly $2.7–3 billion has been frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council, but over 420,000 ETH and 18,270 BTC (~$2.4B) remain unfreezable.

    Technical Details

    • The operator wallet was funded via small Tornado Cash withdrawals; malicious code was trialed on other wallets at least a day and a half in advance.
    • On Ethereum, attackers abused EIP-7702 delegation, submitting a batch of 50 pre-signed permissions from a Binance hot wallet so one would match the wallet's nonce at execution, delegating the wallet to an attacker-controlled contract.
    • On the other nine chains, funds moved via regular, validly signed transactions across different key types and signing schemes within ~30 minutes, leading TRM to assess the attacker gained the ability to make Binance's hot wallet signing system sign arbitrary transactions.
    • Laundering differed from Bybit: instead of cross-chain bridges, attackers used large trades with market makers and lending platforms, dumping USDT for ETH at >10% below market to outrun issuer freezes.

    Remediation

    Binance halted withdrawals and pledged full reimbursement via company funds and the Secure Asset Fund for Users (SAFU). Exchanges should review endpoint hardening for DevOps staff, isolate signing infrastructure from developer workstations, enforce transaction policy controls on hot wallet signers, and monitor for anomalous EIP-7702 delegations.

21. gbhackers.com ↗ · pub. 30/10/2026 03:18 · coletado 30/10 04:00

    Binance halts deposits and withdrawals after breach; estimates of stolen crypto range from $5.7B to $6.3B

    ler a análise desta fonte ocultar

    Binance suspended all deposits and withdrawals following a security incident in which attackers allegedly drained billions in cryptocurrency from internet-connected hot wallets. Early blockchain-tracking estimates put losses at roughly $5.7 billion, with later figures of about $5.9 billion cited by Chainalysis and around $6.3 billion attributed to Binance itself. The exchange stated that user funds remain safe, that it will cover all losses, and that it is working with law enforcement while preparing a full postmortem. Preliminary findings point to a compromised DevOps engineer's laptop that allowed an attacker to reach a service container and submit unauthorized withdrawal transactions, though no completed forensic determination has been published. Frozen assets have risen from $2.54 billion to roughly $3 billion, aided by Tether (over $1.57 billion USDT) and Circle (around $800 million USDC).

    Technical Details

    Binance's preliminary account describes endpoint compromise of a DevOps engineer leading to access to a service container and unauthorized withdrawal submissions from hot wallets. The initial infection method, exploited vulnerability, persistence mechanism and credentials involved have not been disclosed; the article explicitly notes it is unknown whether phishing, malware or another technique was used. Comparisons to the Bybit exchange theft have been made, but no shared attacker or identical exploitation method has been established.

    Remediation

    Binance advises users to rely exclusively on official channels and to ignore unofficial links, messages or requests for account information, as scam activity typically follows such incidents. Deposits and withdrawals remain suspended as a precaution while security checks and asset freezes proceed.

22. thehackernews.com ↗ · pub. 30/10/2026 01:14 · coletado 30/10 03:00

    Binance breach impacts $6.3B in assets; compromised DevOps engineer laptop enabled unauthorized withdrawals

    ler a análise desta fonte ocultar

    Binance disclosed a "security incident" affecting approximately $6.3 billion in assets, with nearly $3 billion frozen on-chain so far. Initial investigation points to a compromised DevOps engineer's laptop, which gave the attacker access to a service container from which unauthorized withdrawal transactions were submitted; Binance says there is no evidence of wallet private key leakage. Tether froze over 1.567 billion USDT, Circle froze 800 million, and the Arbitrum Security Council froze about $30.5 million tied to the exploit. Chainalysis estimates roughly $5.912 billion stolen at the time of theft, nearly 4x the Bybit February 2025 heist (~$1.5B, attributed to North Korea), making it the largest crypto heist on record. Binance will cover losses via its SAFU fund and its own reserves. Story is still developing.

    Technical Details

    • Initial access attributed to a compromised endpoint (DevOps engineer's laptop).
    • Lateral movement into a service container with privileges to submit withdrawal transactions.
    • No private key compromise claimed; abuse of authorized infrastructure paths instead.

    Remediation

    • Binance temporarily suspended deposits and withdrawals pending security checks.
    • Revoked the affected address authorization.
    • Engaged law enforcement and blockchain intelligence partners to trace and recover funds.
    • Stablecoin issuers executed on-chain freezes of attacker-controlled funds.
23. theregister.com ↗ · pub. 30/10/2026 01:22 · coletado 30/10 02:00 primeiro registro

    Binance halts trading after DevOps engineer's laptop compromise enables $6.3B in unauthorized transactions

    ler a análise desta fonte ocultar

    Binance paused all trading, deposits and withdrawals after attackers compromised a DevOps engineer's laptop and used the access to submit unauthorized withdrawal transactions. The exchange initially froze $2.5 billion in assets and later raised its at-risk estimate to $6.3 billion, saying the figure could grow as it works with law enforcement, token issuers and blockchain intelligence firms to trace and freeze more funds. Binance says user funds are safe, that it found no evidence of any wallet private key leak, and that it will cover any customer losses. The initial access method is not yet disclosed; phishing or a supply chain compromise of a developer package cannot be ruled out. Binance also warned users to beware of scam links and messages exploiting the incident.

    Technical Details

    Per Binance's own update, the compromised engineer laptop allowed the attacker to reach a service container, from which unauthorized withdrawal transactions were submitted. No private key leakage has been identified. Trading remained suspended at the time of reporting.

    Remediation

    Binance halted trading, deposits and withdrawals, froze assets with partners, and pledged full reimbursement. Users should ignore unofficial links or requests for account information circulating around the incident.