FBI blames record ~$6.3B Binance heist on North Korea's TraderTraitor; Pyongyang denies, Binance resumes phased withdrawals

Linha do tempo

1. olhardigital.com.br ↗ · pub. 02/11/2026 22:12 · coletado 02/11 23:01

   North Korea denies FBI attribution of $6B+ Binance crypto theft to TraderTraitor

   ler a análise desta fonte ocultar

   North Korea rejected as "absurd rhetoric" the US accusation that it was behind the hack that drained more than US$6 billion in cryptocurrency from Binance. The statement came through state agency KCNA, attributed to Kim Yo Jong, who said the FBI is trying to portray the country as a "cyber criminal state". Over the weekend the FBI attributed the theft to members of a North Korean state unit known as TraderTraitor, in what may be the largest cryptocurrency theft on record. Authorities observed the perpetrators converting the stolen assets into Ethereum, which could support later laundering stages. Binance said it covered most of the stolen assets with its own funds.

   Technical Details

   • Attribution by the FBI: TraderTraitor, a North Korean state-linked unit.
   • Stolen assets are being converted to Ethereum, a likely precursor to laundering.
   • The article gives no details on the intrusion vector, malware or IOCs.
   • Security experts quoted say North Korea-linked hackers are among the most active in crypto theft, with proceeds funding weapons programs.
2. theregister.com ↗ · pub. 02/11/2026 08:45 · coletado 02/11 10:00

   FBI attributes record $6.3B Binance crypto heist to North Korea's TraderTraitor (Lazarus)

   ler a análise desta fonte ocultar

   The FBI has attributed the October 29 theft of roughly $6.3 billion in cryptocurrency from Binance to TraderTraitor, a North Korean operation linked to Lazarus Group. Blockchain intelligence firms TRM Labs and Elliptic had already tied the theft to North Korea; TRM said most of the haul moved in about 20 minutes, and Elliptic verified that $2.85 billion has been frozen or seized. Binance says it has replenished about 95% of the stolen assets and resumed withdrawals, but recorded about $3.64 billion in net outflows (around 2.1% of reported assets).

   Technical Details

   • Per Binance, the intrusion began with a compromised DevOps engineer's laptop, which gave the attackers access to a service container and let them authorize illegitimate withdrawals.
   • The FBI says the actors are swapping the loot for Ethereum and are expected to launder it through DeFi platforms and instant swap services.
   • TraderTraitor has previously used fake job offers and recruitment exercises to gain access to employers' systems, and has been linked to the $308 million DMM Bitcoin theft in 2024.
   • Bitget separately confirmed that its $387.5 million theft also bears hallmarks of a North Korean operation, citing "IP behavioral patterns and on-chain signatures".

   Remediation

   • The FBI published a list of wallet addresses linked to the theft and urges exchanges, blockchain analytics firms and other virtual asset providers to block transactions involving the stolen funds.
3. helpnetsecurity.com ↗ · pub. 02/11/2026 07:12 · coletado 02/11 08:01

   FBI attributes $6.3B Binance crypto heist to North Korea's TraderTraitor; scammers exploit withdrawal pause

   ler a análise desta fonte ocultar

   The FBI confirmed in an alert published October 31 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, tying the attack to TraderTraitor, the group named in the $1.5 billion Bybit hack of February 2025. TRM Labs and Chainalysis attributed the heist to the group within a day. Binance said it replaced about 95% of the stolen assets with its own funds and began phased restoration of withdrawals on November 1. Scammers are meanwhile circulating fake posts claiming a $150 compensation reward for affected users.

   Technical Details

   • Binance first said the attacker may have gained access through a compromised DevOps engineer's laptop, which allowed access to a service container and unauthorized withdrawals; investigators later found further breaches.
   • About $6.3 billion left Binance wallets on October 29; Tether, Circle and partners froze close to $3 billion within the first day.
   • The actors converted stolen assets mostly into Ethereum and are expected to launder them through DeFi platforms and instant swap services.
   • The FBI alert lists 628 addresses: 608 Ethereum, 19 Bitcoin and 1 Solana.
   • Scam campaign: fake social media posts and screenshots claim a $150 Binance compensation reward claimable through the Binance app.

   Remediation

   • Node operators, instant exchanges, DeFi services, blockchain analytics firms and other crypto providers are urged to block transactions linked to the 628 listed addresses.
   • Users should rely only on official Binance channels and announcements and ignore compensation claims.
4. infosecurity-magazine.com ↗ · pub. 02/11/2026 07:15 · coletado 02/11 08:01

   FBI attributes $6bn Binance crypto heist to North Korea's TraderTraitor; laundering via ETH, DeFi and instant swaps

   ler a análise desta fonte ocultar

   The FBI, with the US Secret Service and IRS-CI, attributed the theft of more than $6bn from cryptocurrency exchange Binance to North Korea's TraderTraitor group (aka Jade Sleet, UNC4899, Slow Pisces) in a statement published on October 31. The FBI says the actors are converting stolen assets primarily into Ethereum (ETH) and are expected to launder them further through DeFi products and instant swap services. Elliptic reports that around $2.9bn has been frozen or seized, leaving roughly $3.25bn the attacker controls across more than 800 addresses. Binance says it will cover the losses, so customer funds are safe, while its investigation into the root cause continues.

   Technical Details

   • Binance first suspected a compromised DevOps laptop, then said it "uncovered additional points of breach" in a "complex attack".
   • Per Elliptic, more than one individual carried out the attack, and a self-destruct mechanism destroyed tooling and traces as it ran, hampering forensics.
   • Elliptic says the unfreezable holdings include about 584,000 ETH ($1.32bn), 18,327 BTC ($1.42bn) and 233 million XRP.
   • Stolen TRX has almost entirely been laundered through bridges onto Ethereum and split across hundreds of fresh wallets.
   • XRP, SOL and NEAR, worth about $439m, have not moved since the theft.
   • TraderTraitor has links to Lazarus Group, APT38 and AppleJeus. Past heists attributed to it include DMM ($308m), Alphapo ($60m), CoinsPaid ($37m), Atomic Wallet ($100m) and Bybit ($1.5bn).

   Remediation

   The FBI urges THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other VASPs to block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets.

5. securityweek.com ↗ · pub. 02/11/2026 05:40 · coletado 02/11 06:00

   FBI attributes $6.3B Binance heist to North Korea's TraderTraitor, flags 600+ laundering addresses

   ler a análise desta fonte ocultar

   The FBI, with the USSS and IRS-CI, formally attributed the October 29 theft from Binance hot wallets to North Korean state-sponsored group TraderTraitor. Binance estimates losses at about $6.3 billion (Elliptic: $6.43 billion across 11 blockchains), the largest crypto theft on record. The FBI published 608 Ethereum, 19 Bitcoin and 1 Solana addresses that hold or held proceeds, and asked THORChain node operators, RPC node operators, instant exchanges, DeFi services and analytics firms to refuse linked transactions. Laundering appears heavily automated and is expected to take months.

   Technical Details

   • Hackers emptied hot wallets on multiple blockchains, moving most funds in roughly 20 minutes.
   • Binance first suspected a compromised DevOps engineer laptop, but co-CEO Richard Teng said later investigation found additional breach points and that the attack "was not carried out by one person".
   • The attacker deployed a self-destruct mechanism that wiped tooling and evidence.
   • Use of Ethereum's EIP-7702 delegation feature "did not pass through our normal approval controls".
   • The FBI observed conversion of stolen assets primarily into ETH, followed by DeFi and instant swap services.
   • Elliptic: $2.85 billion frozen or seized; the attacker controls about $3.25 billion non-freezable assets across 800+ addresses (about 584,000 ETH, 18,327 BTC, 233 million XRP).
   • The main Tron distribution wallet paid out hourly around the clock; when a bridge refused deposits, funds were rerouted through fresh wallets. About $196 million went to ~200 wallets by late October 31, with THORChain the largest exit (~$31 million).
   • Chainalysis also noted automation patterns, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.
   • TRM Labs and Chainalysis linked the attack to TraderTraitor within hours. The same group was blamed for the $1.5 billion Bybit hack in February 2025.

   Remediation

   • Crypto services should block transactions involving the FBI-listed addresses.
   • Binance resumed withdrawals in phases from November 1, has replaced about 95% of stolen funds with company funds and promised a technical post-mortem.
6. gbhackers.com ↗ · pub. 02/11/2026 02:08 · coletado 02/11 03:00

   FBI attributes theft of over $6 billion from Binance to North Korean 'TraderTraitor' actors

   ler a análise desta fonte ocultar

   The FBI has attributed the theft of more than $6 billion in virtual assets from Binance to North Korean hackers tracked as TraderTraitor, in an advisory dated October 31, 2026. The exchange was reportedly targeted around October 29, 2026. The advisory, prepared with the US Secret Service and IRS Criminal Investigation, says the attackers have mostly converted the stolen funds into Ethereum. It does not disclose how Binance was compromised.

   Technical Details

   • The advisory names no exploited vulnerability, malware family, compromised signing mechanism or initial access technique. Attributing the intrusion to phishing, stolen private keys or a supply chain compromise would go beyond what the FBI disclosed.
   • Authorities expect laundering through DeFi platforms and instant swap services. This is an expectation and has not been confirmed.
   • The article says the advisory introduces a list of TraderTraitor addresses, but the text supplied contains no wallet addresses, transaction hashes, malware hashes, affected software versions or forensic timeline.
   • TraderTraitor's past tradecraft (social engineering, credential theft, compromised development environments) gives context on the actor's capabilities but is not evidence for this incident.

   Remediation

   • THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers are asked to block transactions involving the attacker addresses and funds derived from them.
   • Anyone with relevant information can report it to the FBI's IC3.
7. cybersecuritydive.com ↗ · pub. 30/10/2026 11:19 · coletado 01/11 22:22 só resumo do feed

   North Korea-linked group steals $6.3B from Binance in largest-ever cryptocurrency hack

   ler a análise desta fonte ocultar

   A North Korea-linked group reportedly stole roughly $6.3 billion from the cryptocurrency exchange Binance, which would make it the largest crypto hack on record. Blockchain analysis firms say they worked with Binance to freeze roughly half of the stolen funds, and the exchange said it would cover all losses. The excerpt gives no details on the intrusion method, the group's name or technical indicators.

8. malwarebytes.com ↗ · pub. 30/10/2026 09:24 · coletado 01/11 22:21

   Binance loses ~$6.3B in record crypto theft; TraderTraitor linked, DevOps laptop suspected as entry point

   ler a análise desta fonte ocultar

   Binance disclosed a security incident affecting roughly $6.3 billion in cryptocurrency, described as the largest crypto theft ever. Its initial investigation points to a compromised DevOps engineer's laptop used to reach a service container and submit unauthorized withdrawals. TRM Labs and Chainalysis attribute the theft to TraderTraitor, a North Korean group tied to earlier crypto heists. Binance says about $3 billion has been frozen and it will cover all losses from its emergency fund and company funds. Binance.US was not affected.

   Technical Details

   • Binance reported no evidence of a wallet private key leak (update of October 30).
   • Co-CEO Richard Teng told BleepingComputer the attacker did not simply use one engineer's permissions; the attack involved a more complex process, and investigators found additional breach points.
   • TRM Labs estimates about $6.36 billion left Binance wallets across ten blockchains, most within about 20 minutes.
   • Frozen and stolen totals from analysts differ and remain developing estimates.

   Remediation

   • Use only official Binance channels (app or support site you open yourself); ignore unexpected messages urging urgent verification or compensation claims.
   • Review transaction history and security settings; contact official support to disable an account or reset password or 2FA if activity looks unfamiliar.
   • Never share authentication codes.
   • Be wary of fake crypto recovery services (FBI warning, 2023).
   • Preserve evidence (messages, wallet addresses, transaction details) if you lose money to a related scam.
9. hackread.com ↗ · pub. 29/10/2026 23:02 · coletado 01/11 22:21

   Binance investigates suspected crypto hack of up to $5.8B; about $3B frozen, EIP-7702 delegation seen before transfers

   ler a análise desta fonte ocultar

   Binance is investigating a suspected hack after billions of dollars moved out of exchange-associated wallets on October 29, 2026. Outside estimates of the suspicious transfers range from $3.3 billion (Blockaid) to $5.8 billion (Coinbase's Conor Grogan). If the upper figure were confirmed as stolen, it would be the largest publicly reported crypto theft, above the roughly $1.5 billion Bybit theft of February 2025. Binance has not confirmed the amount stolen. It says user funds are "completely safe" and that about $3 billion has been verified as frozen. No attacker has been publicly identified.

   Technical Details

   • Blockaid reported about $3.3B in suspicious outflows across Ethereum, Arbitrum and Avalanche. The estimates come from different stages of the investigation and should not be summed or read as Binance's final loss.
   • Investigators found a signed EIP-7702 authorization 3m24s before the first Ethereum transaction. A Binance-labeled wallet then moved 167,464 ETH plus 63 tokens, including 1.615B USDT.
   • Phylax Systems founder Odysseas Lamtzidi said the delegation could let smart-contract code execute through the wallet and authorize further transfers.
   • How the signature was obtained is unknown. Reporting has not established whether signing credentials or a signing system were compromised, or whether someone was tricked into approving a malicious request. Use of EIP-7702 does not itself indicate a flaw in Ethereum.
   • Circle froze more than 800M USDC tied to the incident, in coordination with law enforcement.
   • The initial compromise may predate the first recorded transfer.
   • The article notes that Bitget reported a hack about a month earlier, with suspected Lazarus Group involvement. It draws no link to the Binance incident.
   • Freezing blocks token transfers but does not mean funds have been returned or define the final recovery.
   • Binance.US said it was unaffected.
   • CZ, who no longer manages Binance, said the activity looked like a hack.

   Remediation

   • Binance is working with law enforcement, token issuers and blockchain intelligence firms to trace and freeze more assets.
   • Customers are told to rely on official Binance announcements and to beware of unofficial links, messages and requests for account information.
10. hackread.com ↗ · pub. 30/10/2026 08:54 · coletado 01/11 22:21

    Binance probes compromised DevOps laptop after $6.3B theft attributed to North Korea's TraderTraitor

    ler a análise desta fonte ocultar

    Binance says its investigation into a roughly $6.3 billion cryptocurrency theft found a compromised DevOps engineer's laptop that let an attacker reach a service container and submit unauthorized withdrawals. Blockchain intelligence firms TRM Labs and Chainalysis attribute the theft to the North Korean group TraderTraitor (linked to Lazarus Group). Binance has stated that the laptop is only an initial finding and that additional breach points exist. Withdrawals remain paused while deposits continue, and the exchange has promised to cover all losses via its SAFU fund.

    Technical Details

    • Binance found no evidence that wallet private keys leaked; it revoked the affected address authorization. This leaves open that attackers abused internal access to obtain valid signatures.
    • TRM Labs calculated about $6.36B left Binance wallets across ten networks, mostly within about 20 minutes starting 20:05 GMT on October 29.
    • Preparation began at least 36 hours earlier, including funding through Tornado Cash and tests of attack code.
    • Valid transactions across many networks pointed to compromised hot-wallet signing infrastructure.
    • On Ethereum, the attacker used EIP-7702 authorizations to make a Binance wallet execute attacker-controlled code and repeatedly forward incoming funds.
    • TRM compared preparation and signing patterns to earlier DPRK thefts including Bybit ($1.5B, Feb 2025). The article notes the tactic resembles North Korean use of Ethereum-based dead drops in malicious npm packages seen in August 2026.
    • Binance has not named the attackers; attribution is from TRM (high confidence) and Chainalysis (likely).
    • About $3B in assets has been frozen by industry partners.

    Remediation

    • Binance is revamping the withdrawal service and related addresses and expects to resume withdrawals within about 45 hours of its update.
    • A technical post-mortem and an updated Proof of Reserves are promised.
    • Malwarebytes' Pieter Arntz cautions against treating the laptop as the full cause; the question is why safeguards failed to stop unauthorized transactions.
11. hackread.com ↗ · pub. 01/11/2026 08:11 · coletado 01/11 22:21

    FBI Attributes $6.3B Binance Theft to North Korea's TraderTraitor, Publishes 628 Crypto Wallet Addresses

    ler a análise desta fonte ocultar

    The FBI has attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea, naming the activity TraderTraitor. In an October 31 announcement, the bureau said the theft occurred on or around October 29, 2026, and published 628 addresses tied to the stolen funds. Binance estimates the loss at about $6.3 billion, with roughly $3 billion verified as frozen. The FBI, US Secret Service and IRS Criminal Investigation are asking crypto businesses to block transactions involving the listed addresses.

    Technical Details

    • Binance's first detailed explanation: a compromised DevOps engineer's laptop appeared to let the attacker reach a service container and submit unauthorised withdrawal transactions. Binance found no evidence of wallet private key leakage.
    • Binance later identified additional breach points without explaining them publicly. It promised to cover all losses and to publish a technical report after its investigation.
    • The FBI alert lists 608 Ethereum, 19 Bitcoin and 1 Solana addresses that hold or previously held stolen assets and are operated by or closely tied to TraderTraitor.
    • Investigators have seen the attackers converting stolen assets mainly into Ethereum and expect further laundering via DeFi platforms and instant swap services.
    • The FBI announcement does not explain how the laptop was compromised or give a full account of the attack.

    Remediation

    • THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other VASPs are asked to block transactions involving the listed addresses and funds derived from them.
    • Anyone with information should contact an FBI field office or file a report with the Internet Crime Complaint Center (IC3).
12. helpnetsecurity.com ↗ · pub. 30/10/2026 05:26 · coletado 01/11 22:21

    Binance hit by ~$6.3B crypto theft via compromised DevOps laptop; TRM and Chainalysis link it to North Korea's TraderTraitor

    ler a análise desta fonte ocultar

    About $6.3 billion in cryptocurrency was stolen from Binance, which would make it the largest crypto heist on record. Binance's initial investigation points to a compromised DevOps engineer's laptop that let the attacker reach a service container and submit unauthorized withdrawals, though a later update said additional breaches went beyond the laptop. TRM Labs and Chainalysis attribute the attack, with high confidence and likely respectively, to the North Korean group TraderTraitor. Binance says it will cover all losses from the SAFU fund and company funds, and user funds are safe.

    Technical Details

    • Binance found no evidence of a wallet private key leak. It is tracing the attack path through the compromised laptop and has said the attacker did not simply use one engineer's permissions.
    • TRM counts about $6.36B leaving Binance wallets across ten blockchains. Wallets with different key types and signing schemes all produced valid signatures within about 30 minutes, which TRM says indicates a compromise of Binance's hot wallet signing infrastructure.
    • On Ethereum, attackers took control of a hot wallet using 50 pre-signed authorizations, and TRM's early indicators suggested they had been phished. Phishing would not explain the activity on the other chains.
    • Tether froze more than 1.567B USDT and Circle froze more than 800M USDC. Freezes by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council reached about $2.7B, and Binance cites close to $3B frozen on-chain.
    • Attackers still hold more than 420,000 ETH and 18,270 BTC (about $2.4B). TRM expects them to move through cross-chain bridges, swap services and OTC brokers.

    Remediation

    • Binance revoked the affected address authorization and is revamping the withdrawal service and its related addresses. Withdrawals are expected to resume within 48 hours, and an updated Proof of Reserves and a technical post-mortem are promised.
    • TRM advises exchanges to screen deposits against the addresses it has tied to the theft.
13. securityaffairs.com ↗ · pub. 01/11/2026 16:23 · coletado 01/11 17:00

    FBI attributes $6B Binance crypto theft to North Korea's TraderTraitor (Lazarus/APT38)

    ler a análise desta fonte ocultar

    The FBI has attributed the theft of more than $6 billion in virtual assets from the Binance exchange, on or about October 29, 2026, to North Korea's TraderTraitor cluster, also tracked as Lazarus Group and APT38. TRM was first to attribute the attack to TraderTraitor and Chainalysis also expressed high confidence, while Binance has not named a culprit. TRM says about $6.36 billion left Binance wallets on ten blockchains, mostly within about 20 minutes from 20:05 UTC, making this the largest crypto theft on record, roughly four times the Bybit hack of February 2025. The FBI, USSS and IRS-CI are asking crypto service providers to block transactions tied to the actor's wallet addresses as the funds are laundered.

    Technical Details

    • Attackers used access from an engineer's laptop to reach a service container and send unauthorized withdrawal requests. Binance says it found no evidence that wallet private keys were stolen.
    • The agencies observed the actors converting stolen assets primarily into Ethereum (ETH), with further laundering expected through DeFi and instant swap services.
    • Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB (roughly $2.7 billion in all). Early reports put the Tether and Circle freezes at about $1.79 billion; the figures describe different moments and should not be summed blindly.
    • The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach.

    Remediation

    • THORNode operators, RPC node operators, instant exchanges, DeFi platforms, blockchain analytics firms and other crypto service providers should block transactions involving the TraderTraitor wallet addresses listed in the FBI alert, including funds derived from them.
    • Check blocklists against the FBI list and review transaction flows that touch those addresses indirectly.
    • Information can be reported to a local FBI field office or ic3.gov.
14. bleepingcomputer.com ↗ · pub. 01/11/2026 16:57 · coletado 01/11 17:00

    FBI attributes $6.3B Binance crypto heist to North Korea's TraderTraitor (Lazarus)

    ler a análise desta fonte ocultar

    The FBI has formally attributed the theft of roughly $6.3-6.36 billion in virtual assets from Binance, on or about October 29, 2026, to North Korea's TraderTraitor (also tracked as Lazarus Group, Jade Sleet and APT38). It is the largest cryptocurrency heist on record. The attribution follows earlier links made by TRM Labs and Chainalysis. Binance previously tied the breach to a compromised DevOps engineer's laptop, which gave the attackers access to a service container from which they submitted unauthorized withdrawals across ten blockchains, mostly within 20 minutes. Binance says it has covered about 95% of the impacted amount and plans to resume the first phase of withdrawals on November 1.

    Technical Details

    • The attackers used the compromised DevOps laptop to reach a service container and submit unauthorized withdrawal transactions, per Binance.
    • The FBI observed TraderTraitor converting stolen assets mainly into Ethereum (ETH) and expects further laundering through DeFi platforms and instant swap services.
    • The FBI published 628 associated addresses: 608 Ethereum, 19 Bitcoin and 1 Solana.
    • Prior TraderTraitor thefts cited: Bitget ($387.5M, Sep 2026), Drift ($280M, Apr 2026), Bybit ($1.5B, Feb 2025) and DMM Bitcoin ($308M, May 2024). These involved developer or employee compromise through fake recruiter approaches (Operation DreamJob), malicious Python code disguised as a pre-employment test, a compromised Safe{Wallet} developer machine, and a six-month in-person social engineering campaign against Drift contributors.

    Remediation

    • The FBI, U.S. Secret Service and IRS Criminal Investigation ask exchanges, blockchain operators and other virtual asset service providers to block transactions linked to the published addresses.
    • Defenders at crypto firms should harden developer and DevOps endpoints and train staff on fake-recruiter and conference-based social engineering.
    • Binance states it will bear the losses, that users will not, and that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed.
15. techcrunch.com ↗ · pub. 01/11/2026 13:20 · coletado 01/11 15:00

    Binance resumes phased withdrawals after $6.3B theft attributed by FBI to North Korea's TraderTraitor

    ler a análise desta fonte ocultar

    Binance announced on 1 November 2026 that it is resuming withdrawals in phases, after freezing deposits and withdrawals following the theft of $6.3 billion in crypto from its wallets. The exchange says it has covered 95% of the stolen assets and is still sourcing the remaining, less liquid ones. It also states that it will absorb the losses and not pass them on to users. On 31 October the FBI attributed the breach to the North Korean group TraderTraitor, which is converting the proceeds mainly into Ethereum, with further laundering expected. Binance had earlier blamed North Korean hackers and plans to publish a detailed incident report once its investigation is complete.

    Technical Details

    • The article does not describe the intrusion vector or the technical method of compromise.
    • The FBI says TraderTraitor is converting the stolen assets primarily into Ethereum and that further laundering is likely.
    • Network status on 1 November showed mixed states: Bitcoin withdrawals and deposits partially suspended, Ethereum deposits normal and withdrawals partially suspended.
    • Users should expect delays and longer processing times due to traffic volume.

    Remediation

    • Binance froze deposits and withdrawals to contain losses, assess impact, restore services and complete security checks.
    • It is restoring withdrawals in phases by network and asset type, and says it is strengthening safeguards and completing recovery.
    • A full incident report is promised after the investigation ends.
16. olhardigital.com.br ↗ · pub. 01/11/2026 09:46 · coletado 01/11 11:01

    FBI attributes $6.3B Binance theft to North Korea's TraderTraitor after compromise of an engineer's laptop

    ler a análise desta fonte ocultar

    The FBI has formally attributed to North Korea the theft of about US$ 6.3 billion in digital assets from Binance, the world's largest cryptocurrency exchange, carried out around 29 October. The FBI says the operation was conducted by TraderTraitor, a state-sponsored group that CISA describes as part of Lazarus Group. The attackers were seen converting part of the loot into Ether, and the FBI expects laundering through DeFi platforms and instant swap services. It asked industry firms to block transactions tied to the group's addresses. Binance says it has covered 95% of the stolen assets with its own funds, and about US$ 3 billion has been located with partners. Withdrawals began resuming on 1 November.

    Technical Details

    • Binance co-CEO Richard Teng described a complex attack involving several vulnerabilities.
    • Initial findings suggest a compromised laptop belonging to a company engineer served as the entry point, giving access to an internal system used to authorize unauthorized withdrawals.
    • The attackers reportedly used malware designed to erase evidence of their activity, hampering tracing and investigation.
    • Most funds were drained in about 20 minutes on the night of 29 October.
    • TraderTraitor has been active since at least 2020 and uses spear phishing and malware distribution. It was also linked to the roughly US$ 1.5 billion Bybit theft in February 2025.
    • Private blockchain analytics firms had pointed to North Korean involvement before the FBI statement.

    Remediation

    • Crypto industry firms are asked by the FBI to block transactions related to the digital addresses used by the group.
    • Binance suspended deposits and withdrawals, worked with partners to freeze assets, and replenished funds from SAFU, its futures insurance fund and corporate cash.
17. thehackernews.com ↗ · pub. 01/11/2026 03:44 · coletado 01/11 05:00

    FBI attributes record $6.43B Binance crypto heist to North Korea's TraderTraitor (Jade Sleet)

    ler a análise desta fonte ocultar

    The FBI, together with the U.S. Secret Service and IRS-CI, has attributed the theft of more than $6 billion in virtual assets, reported as a $6.43 billion Binance heist, to TraderTraitor (also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899), a North Korea-aligned group. It is the largest cryptocurrency theft on record, surpassing the $1.46 billion Bybit theft of February 2025. The funds were taken across 11 blockchains, 82% of them on Ethereum and Bitcoin, and the actor is converting them primarily into ETH ahead of further laundering through DeFi and instant swap services. Of the total, $2.85 billion has been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. Binance has resumed phase one of withdrawals, and deposits were not affected.

    Technical Details

    • The article does not state how Binance was compromised. It describes TraderTraitor's recent tradecraft as reported by SentinelOne, Zscaler ThreatLabz and Microsoft.
    • Trojanized Terraform providers deliver a Bash loader that selects and downloads malware matching the victim's OS (macOS, Linux, Windows). This includes the cross-platform implant FLATROOF, which uses a Python-based information stealer and finally drops the ROOFDECK backdoor for full remote control.
    • Recruitment-themed social engineering uses front companies, tailored domains and social media profiles to pose as recruiters for a spoofed AI-powered blockchain intelligence company, targeting people in cybersecurity, AI, blockchain and talent recruitment. AI is used to craft lures and fake personas and to evade detection.
    • The group has been active since at least 2020 and has been linked to the DMM Bitcoin, Bybit, KelpDAO and Bitget thefts.
    • The FBI published a list of wallet addresses used for laundering; the article does not reproduce them.
    • Elliptic estimates DPRK-linked actors have stolen over $6.5 billion in cryptoassets in recent years.

    Remediation

    • The article gives no explicit remediation. Defenders can use the FBI-published wallet list for blocking and monitoring, and should treat unsolicited job-themed outreach and third-party Terraform providers as untrusted.
18. olhardigital.com.br ↗ · pub. 30/10/2026 20:37 · coletado 30/10 21:00

    Binance hot wallets drained of about US$6.3B; TRM Labs and Chainalysis point to North Korea's TraderTraitor, US investigating

    ler a análise desta fonte ocultar

    A cyberattack drained roughly US$6.3 billion in cryptocurrency from hot wallets used by Binance to process transactions, most of it in about 20 minutes from late 29 October 2026. TRM Labs attributed the theft to TraderTraitor, a North Korea-linked unit, with high confidence, and Chainalysis shared that conclusion. Binance has not confirmed the attribution. President Donald Trump said on 30 October that the US government is looking into possible North Korean involvement. The FBI is aware of the incident and Binance is also working with the US Secret Service (per Reuters). Binance says it has set aside about US$6.34 billion of its own funds to cover losses, and that no customer funds were used.

    Technical Details

    • Binance's initial investigation suggests the intrusion may have started with the compromise of a Binance engineer's computer. Other possible entry points were identified later.
    • Co-CEO Richard Teng described the attack as complex. It involved manipulating a system that approves transactions, which let the attackers move funds from an internet-connected wallet without the usual authorization controls.
    • Binance reported that the attackers used software to erase traces and evidence of their activity, which hampers the investigation.
    • The affected assets were hot wallets, which are more exposed than offline cold wallets.
    • Blockchain analytics firms say the incident resembles the Bybit theft of about US$1.5 billion in February 2025, which the FBI attributed to North Korea and TraderTraitor.
    • North Korea routinely denies involvement in cyberattacks. Its representatives in Switzerland and China did not respond to Reuters.

    Remediation

    • Binance temporarily suspended withdrawals and said it expected to resume them within 48 hours.
    • Binance has traced about US$3 billion of the stolen funds with partners. Tether froze about US$1.57 billion and Circle blocked more than US$800 million.
    • The destination of the remaining roughly US$3.3 billion had not been clarified.
    • Market impact: Bitcoin fell to US$76,368, a six-week low, and Ether dropped more than 3% to US$2,178.
19. securityaffairs.com ↗ · pub. 30/10/2026 15:50 · coletado 30/10 17:00

    Binance loses about $6.3B in record crypto theft via compromised DevOps laptop; TRM and Chainalysis attribute it to DPRK's TraderTraitor

    ler a análise desta fonte ocultar

    Binance confirmed a security incident on October 29, 2026, in which an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, mostly within about 20 minutes starting at 20:05 UTC. This is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. Binance Co-CEO Richard Teng said the incident may have started with a compromised DevOps engineer's laptop, which gave the attacker access to a service container used to submit unauthorized withdrawals. Binance has not named a culprit, but TRM attributes the attack to TraderTraitor (also tracked as Lazarus Group and APT38) with high confidence, and Chainalysis also reports a high degree of confidence in DPRK responsibility. Binance says user funds are safe and that it will cover all losses with its SAFU fund and its own money.

    Technical Details

    • Per Binance, the attacker used access from the engineer's laptop to reach a service container and submit unauthorized withdrawal transactions. Teng stressed this was not a single "one-click" action but a more complex attack process, and that the attacker did not simply use one engineer's permissions.
    • Binance reports no evidence that wallet private keys were stolen. It also said it found "additional points of breach" and is still investigating.
    • Early on-chain estimates varied. Analyst Spreek flagged about $3.55B in incoming transfers to one unlabeled wallet, and Coinbase's Conor Grogan estimated up to $5.8B. These were tracking figures and not confirmed theft totals.
    • Chainalysis observed funds stolen by DPRK in the previous month's Bitget exploit commingling with the funds stolen from Binance.
    • Freezes recovered only part of the funds. Tether, Circle, Ripple and World Liberty Financial froze about $2.67B in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6M ARB, for roughly $2.7B in all. Early reports put the Tether and Circle freezes at about $1.79B, and these figures describe different moments and should not be added together.
    • The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4B beyond any issuer's reach.

    Remediation

    • Binance suspended deposits and withdrawals for security checks, revoked the permissions tied to the affected address, and is working with blockchain analysis firms and law enforcement. It plans to publish an updated Proof of Reserves after recovery.
    • Customers should use only official Binance channels, avoid unsolicited links, and never share passwords, authentication codes or recovery phrases. Security teams should watch for phishing that exploits the incident.
20. olhardigital.com.br ↗ · pub. 30/10/2026 14:36 · coletado 30/10 16:00

    Binance reportedly hit by largest crypto-sector hack, with about US$6.3 billion stolen

    ler a análise desta fonte ocultar

    Brazilian outlet Olhar Digital reports that cybercriminals stole about US$6.3 billion (roughly R$34 billion) from Binance, the world's largest cryptocurrency exchange, on Thursday 29 October 2026. The article calls it the largest hack ever recorded in the crypto sector. It quotes Micaella Ribeiro, co-founder of IAM Brasil, who says the case shows an important transformation in the digital threat landscape. The article is paywalled, so the attack vector, attribution, affected assets and Binance's response are not available, and the figures are not corroborated by other sources.

21. gbhackers.com ↗ · pub. 30/10/2026 13:57 · coletado 30/10 14:00

    TraderTraitor drains about $6.36B from Binance hot wallets across ten blockchains, the largest crypto theft on record

    ler a análise desta fonte ocultar

    North Korea's TraderTraitor group drained about $6.36 billion from Binance wallets across ten blockchains on 29 October 2026, according to TRM Labs, which calls it the largest crypto theft on record and about four times the $1.5 billion Bybit heist of February 2025. Most funds left within about 20 minutes starting at 20:05 UTC, with a second wave around 23:05 UTC hitting Avalanche and Polygon. Binance suspended withdrawals on several networks and says user funds are safe. Binance has not published a root cause, but the BBC reports a preliminary finding pointing to a compromised engineer's laptop. TRM counts about $2.7 billion frozen, while the attacker still controls over 420,000 ETH and 18,270 BTC (about $2.4 billion).

    Technical Details

    • Preparation began at least 36 hours earlier: an operator wallet received small Tornado Cash withdrawals on 28 October, the attacker tested its code on two wallets, rehearsed on a third, and about four hours later installed the same code on a Binance hot wallet.
    • On Ethereum, a single transaction at 20:20 UTC carried 50 EIP-7702 authorizations signed by the Binance hot wallet, delegating it to a sweeper contract that accepted instructions only from the operator. The 50 consecutive nonces guaranteed one signature would remain valid as the wallet's nonce advanced.
    • About 3 min 24 s later the operator moved 167,464 ETH and 63 tokens, including 1.615 billion USDT. The delegation stayed active, so new deposits were swept again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.
    • The other nine chains (including XRP Ledger, Bitcoin, Tron and Solana) used ordinary signed transfers. Despite different key types and signing schemes, all produced valid signatures within about 30 minutes. TRM assesses the attacker could make Binance's hot wallet signing system sign transactions of its choosing.
    • Attribution rests on patterns from earlier heists: Tornado Cash funding, early staging, and pre-obtained signatures executed in one burst, matching the Bybit and KelpDAO attacks.
    • Freezes: Tether about 1.77B USDT, Circle about 825M USDC, Ripple 40.5M RLUSD, World Liberty Financial 27.8M USD1. Arbitrum's Security Council moved 8,426 ETH and 74.6M ARB (about $30M) out of the attacker's reach.
    • The attacker raced the freezes, selling about 325M USDT to market makers for roughly 122,300 ETH at a discount above 10%, and borrowing about 19,760 ETH against USDT on Aave. BTC is moving through a peel chain; TRM expects bridges, swap services and OTC brokers next.

    Remediation

    • Screen deposits and counterparties against labeled attacker addresses; market makers and solvers should screen counterparties before filling large orders.
    • Alert on any EIP-7702 delegation on treasury wallets and reject unexpected authorizations; treat requests for many authorizations across a range of nonces as a compromise indicator.
    • Keep a pre-approved revocation method ready.
    • Separate signing infrastructure and approval paths by chain and wallet tier.
    • The investigation is ongoing and figures may change.
22. aikido.dev ↗ · pub. 30/10/2026 10:13 · coletado 30/10 12:01

    Binance $6.3B theft traced to compromised DevOps engineer laptop, additional breach points found

    ler a análise desta fonte ocultar

    Binance reports a roughly $6.3 billion incident that its initial findings link to a compromised DevOps engineer's laptop, which allegedly gave an attacker access to a service container able to submit unauthorized withdrawal transactions. A later investigation update said further work uncovered additional points of breach beyond the laptop, without detail. Binance says about $3 billion has been frozen on-chain, that it will cover all losses, and that it has so far found no evidence of a wallet private key leak. Co-CEO Richard Teng stated the attack went beyond one engineer's permissions and more than a single click. TRM Labs and Chainalysis attribute the incident to TraderTraitor, a North Korean unit; Binance has not confirmed the attribution.

    Technical Details

    The article, from Aikido, describes the plausible chain rather than confirmed Binance forensics: malicious code on a developer device harvests cloud credentials, SSH and git keys, Kubernetes configs and live session tokens that bypass MFA, then the attacker pivots to internal build servers or cloud accounts and finally to a service authorized to submit withdrawals. Because signing keys typically sit in a vault or HSM and an approval service requests signatures, funds can move without key theft — a view also voiced by Blockaid's CEO (compromise of signing infrastructure). Aikido notes it blocked nearly 500 malware attacks on developer devices in one week, and cites North Korean developer-targeting techniques: fake job interviews with take-home coding tests, malicious npm install scripts, and malicious IDE extensions. Prior examples cited include the npm package react-html2pdf.js (March 2025, attributed to Lazarus Group), the PolinRider campaign hiding obfuscated code in project config files that runs on opening a project in VS Code and rewrites repository history, and the 2025 Bybit theft where a developer laptop was compromised on Feb 4 and a stolen AWS session token enabled malicious code injection on Feb 17 leading to the Feb 21 theft (per Safe findings reported by heise).

    Remediation

    • Deploy endpoint controls that block malicious packages, editor extensions and AI tools before installation; quarantine packages published in the last 48 hours.
    • Keep long-lived credentials off developer disks; issue short-lived, hours-scoped credentials.
    • Require out-of-band approval for high-value actions such as withdrawals so a compromised service cannot self-approve.
    • Alert on credential and session use from anomalous locations or times.
    • Bring contractor and personal machines that reach production under company management.
23. itsecurityguru.org ↗ · pub. 30/10/2026 11:48 · coletado 30/10 12:00

    Binance loses $6.3bn in record crypto heist; TRM Labs attributes to DPRK's TraderTraitor via compromised DevOps laptop

    ler a análise desta fonte ocultar

    Binance confirmed the theft of approximately $6.3 billion in digital assets beginning around 20:05 UTC on 29 October 2026, making it the largest cryptocurrency theft on record — roughly four times the $1.5bn Bybit hack of February 2025. According to TRM Labs, funds drained across ten blockchains including Ethereum, Bitcoin, Tron, XRP Ledger and Solana, with most moved inside 20 minutes. Binance's preliminary findings point to a compromised DevOps engineer's laptop that gave attackers access to a service container able to submit withdrawals; the exchange says there is no evidence of private key leakage but has acknowledged additional points of breach. Around $3 billion was frozen within hours with help from Tether and Circle (over $2.5bn in USDT/USDC), partners and law enforcement, while TRM estimates the attacker still controls over $2.4 billion in ETH and BTC being laundered via Uniswap, Aave and JustLend. TRM attributes the attack "with high confidence" to TraderTraitor, a North Korean state-backed unit linked to Lazarus Group; independent investigator ZachXBT concurs. Bitcoin fell ~5% below $77,000 and BNB dropped ~8%.

    Technical Details

    • Initial access: compromise of a DevOps engineer's endpoint, pivoting to a service container authorised to submit withdrawals — control of the signing/authorisation layer rather than theft of private keys.
    • On Ethereum, the attacker abused EIP-7702 authorisations to make a Binance hot wallet execute an attacker-controlled sweeper contract; the other nine chains saw ordinary signed transfers in the same window.
    • TRM assesses Binance's hot wallet signing infrastructure was likely compromised; no root cause has been published.
    • Pre-attack staging included small Tornado Cash withdrawals funding an operator wallet the day before, plus pre-obtained signatures matching prior DPRK-linked heists.
    • Analysts link the incident to a pattern including Bitget's ~$388m loss in September 2026, also attributed to North Korea and also described as "keys untouched, control layer abused".

    Remediation

    • Treat developer and admin devices as high-value targets; assume any machine or credential is compromised.
    • Enforce independent approval for large transfers; set hard velocity and value limits on fund movement and detect anomalies in seconds.
    • Deploy phishing-resistant MFA, just-in-time privileged access, tightly scoped and monitored human and non-human identities.
    • Inventory exactly which machines and accounts can trigger a transfer, and test whether compensating controls hold when one is compromised.
    • Apply cryptographic separation between systems and tightly controlled paths for sensitive transactions so one foothold does not inherit authority over all assets.
24. techcrunch.com ↗ · pub. 30/10/2026 11:00 · coletado 30/10 12:00

    North Korea's TraderTraitor blamed for record $6.3B crypto theft from Binance via compromised engineer laptop

    ler a análise desta fonte ocultar

    Binance, the world's largest crypto exchange, suffered the largest known cryptocurrency theft in history, with at least $6.3 billion drained from its wallets. Binance stated its initial investigation traced the intrusion to a compromised engineer's laptop, which allowed the attacker to access a service container and submit unauthorized withdrawal transactions. The exchange said there is no evidence its private keys were leaked, and it has suspended all deposits and withdrawals pending investigation. TRM Labs and Elliptic both attributed the heist to North Korean state-linked hackers tracked as TraderTraitor, the same cell blamed for the $1.4B Bybit hack in 2025. Roughly $3 billion has been frozen by industry partners, according to Binance spokesperson Andie Cooper.

    Technical Details

    • Initial access: compromise of a Binance engineer's laptop; the circumstances remain unclear, with TechCrunch noting compromised software/open-source components and malware-bundled apps stealing credentials and session tokens as common vectors.
    • Lateral movement into a service container with authority to submit withdrawal transactions.
    • TRM Labs reports the drain took roughly 20 minutes and calls it the "largest hack in history."
    • Elliptic says some stolen funds landed in the same wallet used in the $351 million Bitget theft earlier this year, reinforcing attribution.

    Remediation

    • Binance suspended all deposits and withdrawals and says it has begun recovering affected assets, working with law enforcement, token issuers and blockchain intelligence firms to trace and freeze funds.
    • Binance pledged to publish an updated proof of reserves once remediation completes; it has not yet provided proof that user funds are safe.
    • Defenders should review segregation between employee endpoints and production signing/withdrawal infrastructure, enforce multi-party approval for high-value transactions, and monitor developer workstations for infostealer and supply-chain compromise.
25. olhardigital.com.br ↗ · pub. 30/10/2026 08:20 · coletado 30/10 10:01

    Binance loses $6.3B in largest crypto exchange hack ever; TRM Labs links theft to North Korean actors

    ler a análise desta fonte ocultar

    Hackers stole approximately $6.3 billion from Binance, the world's largest cryptocurrency exchange, in what analysts describe as the largest theft in the sector's history. According to TRM Labs, the attackers drained Binance wallets across 10 different blockchains, moving most of the funds in roughly 20 minutes, and the firm attributed the operation to North Korean groups based on technical similarities with prior thefts including the 2025 Bybit hack. Chainalysis could not yet confirm the root cause but had traced at least $5.912 billion in stolen assets. Binance's preliminary investigation indicates the intrusion may have begun with the compromise of an engineer's computer, granting the attacker access to an internal system used to perform unauthorized withdrawals. Binance says user deposits were unaffected, withdrawals were expected to resume within 48 hours, and co-founder Yi He stated the company will cover all losses.

    Technical Details

    • Wallets drained across 10 blockchains, with the bulk of funds moved in ~20 minutes.
    • Initial access hypothesis: compromise of an engineer's workstation leading to access to a Binance internal system (T1078, T1199 style trusted-access abuse).
    • Mark Karpeles (ex-Mt. Gox) suggested the attacker may have obtained valid authorization to move funds and possibly access to a private key.
    • Attribution to DPRK-linked actors by TRM Labs, echoing the FBI's attribution of the 2025 Bybit theft.

    Remediation

    • Binance worked with partners to freeze roughly $3 billion: Tether froze ~$1.57B, Circle blocked >$800M, Ripple froze ~$200M, and World Liberty Financial with custodian BitGo froze $27M in stablecoins and ~$2M in its tokens.
    • Binance maintains a Bitcoin-denominated customer protection fund (SAFU-style) to absorb losses.
    • Market impact: Bitcoin fell >3% to a six-week low of $76,368, Ether fell >3% to $2,178, Coinbase shares dropped 4.8% and Strategy nearly 6%.
26. wired.com ↗ · pub. 30/10/2026 08:36 · coletado 30/10 10:01

    $6.3B Binance hot wallet heist executed in 20 minutes, tracing firms point to North Korea's TraderTraitor

    ler a análise desta fonte ocultar

    Binance lost roughly $6.3 billion in cryptocurrency on October 29, 2026, with the bulk drained in about 20 minutes from hot wallets spanning at least ten blockchains including Ethereum, Bitcoin, Tron and Solana. Binance suspended deposits and withdrawals, pledged to cover all losses, and said its investigation initially pointed to a compromised engineer's laptop but has since uncovered "additional points of breach." Tracing firms TRM Labs, Chainalysis and Elliptic assess North Korean involvement, with TRM and Chainalysis specifically linking the operation to TraderTraitor, the group the FBI blamed for the $1.5 billion Bybit heist. Chainalysis investigators observed stolen funds commingling in real time with proceeds of the earlier Bitget exploit attributed to DPRK actors. Around $2.8 billion (44%), almost all stablecoins, has been frozen; the remaining ~$3.3 billion in Bitcoin, Ether and XRP cannot be frozen.

    Technical Details

    • Preparation began at least 36 hours before the theft (TRM Labs). The operator funded a wallet via Tornado Cash and received three small test withdrawals.
    • Early on October 29 the attacker deployed a first version of the attack code and tested it on two wallets, then rehearsed the final version on a third wallet and routed test funds back to itself.
    • Four hours after the rehearsal the same code was installed on a Binance hot wallet, draining funds to multiple addresses controlled by a single attacker.
    • Chainalysis reports laundering patterns not previously seen, with thousands of rapid transactions indicating automation used to obscure the fund trail.
    • Targeting crypto staff with social engineering and bespoke fake applications is described as a TraderTraitor hallmark (Elliptic, Sophos).

    Remediation

    Crypto exchanges and custodians should coordinate freezing of flagged stablecoin addresses, monitor for inbound laundered funds, and harden developer and engineer endpoints against laptop compromise, including strict separation between workstation access and hot wallet signing infrastructure.

27. infosecurity-magazine.com ↗ · pub. 30/10/2026 08:25 · coletado 30/10 10:01

    Binance confirms record $6.3bn crypto theft attributed to North Korea's TraderTraitor

    ler a análise desta fonte ocultar

    Binance has confirmed the largest cryptocurrency heist on record, with $6.3bn in crypto stolen. In an October 30 statement, the exchange said the likely entry point was a compromised DevOps engineer's laptop, which gave the attacker access to a service container and allowed submission of unauthorized withdrawal transactions; subsequent investigation uncovered additional points of breach. Binance says it has frozen $3bn of the stolen funds and will cover all losses via its SAFU fund and company funds, and found no evidence that wallet private keys were leaked. TRM Labs, Elliptic and Chainalysis attribute the attack with high confidence to TraderTraitor, a North Korean threat group. Withdrawals remain suspended pending a security revamp, with resumption expected within 45 hours; deposits have resumed.

    Technical Details

    • Initial access suspected via a compromised DevOps engineer endpoint, pivoting to a service container used to sign/submit withdrawal transactions.
    • Binance states multiple breach points were later identified and describes the intrusion as a complex attack; a full technical post-mortem is pending.
    • Unauthorized outflows stopped once withdrawals were paused; the affected address authorization was revoked.

    Remediation

    • Temporary suspension of withdrawals and Binance Alpha trading activities; deposits restored.
    • Security revamp of the withdrawal service and related addresses, updated proof of reserves to follow.
    • Users warned of scams and phishing exploiting the incident: trust only official Binance channels and never share account information.
28. digit.fyi ↗ · pub. 30/10/2026 08:16 · coletado 30/10 10:00

    Binance reports $6.3B crypto theft attributed to North Korea's TraderTraitor

    ler a análise desta fonte ocultar

    Binance disclosed a cyberattack affecting approximately $6.3 billion in digital assets, potentially the largest cryptocurrency hack on record. The exchange says roughly half the affected assets have been frozen with help from other platforms and pledged to cover all losses. Initial investigation points to a compromised laptop belonging to a Binance engineer as the entry point, enabling unauthorised withdrawals. Blockchain analytics firms TRM Labs and Chainalysis both attribute the intrusion to TraderTraitor, a North Korean group also linked to the 2025 Bybit hack ($1.5bn). Binance has not confirmed the DPRK attribution and says it is cooperating with law enforcement; Binance.US is unaffected.

    Technical Details

    • Suspected initial access via an engineer's compromised endpoint, consistent with TraderTraitor's history of social engineering and developer/employee targeting.
    • Attack elements resemble prior DPRK-linked exchange intrusions, notably Bybit (2025).
    • The attacker reportedly still controls a substantial portion of the stolen assets; tracing and recovery are ongoing.

    Remediation

    • Exchanges should harden privileged engineer workstations, enforce hardware-backed MFA, segment signing infrastructure and apply multi-party approval for withdrawals.
    • Monitor for anomalous withdrawal flows and coordinate with analytics providers for asset freezing.
29. bleepingcomputer.com ↗ · pub. 30/10/2026 06:18 · coletado 30/10 07:00

    Binance traces record $6.3B crypto theft to compromised DevOps engineer laptop; TraderTraitor blamed

    ler a análise desta fonte ocultar

    Binance has attributed the theft of roughly $6.3 billion in cryptocurrency to a compromised DevOps engineer's laptop, which attackers used to reach a service container and submit unauthorized withdrawal transactions. Co-CEO Richard Teng stressed the intrusion was not a single "one-click" action and that no leaked wallet private key has been found; the company says it "uncovered additional points of breach" and is still investigating. Blockchain intelligence firms TRM Labs and Chainalysis attribute the attack with high confidence to TraderTraitor, the North Korean state-backed unit also tracked as Lazarus Group and APT38. Roughly $2.7 billion has been frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council, but about $2.4 billion in ETH and BTC remains beyond issuer control. At $6.36 billion, this surpasses the February 2025 Bybit hack as the largest crypto theft on record.

    Technical Details

    Access to a DevOps engineer's endpoint enabled lateral movement into a service container from which unauthorized withdrawals were submitted. On 29 October 2026, approximately USD 6.36 billion moved out of Binance wallets across ten blockchains, most of it within about 20 minutes starting at 20:05 UTC. The attacker outran freezing actions by selling USDT to market makers and borrowing ETH against USDT on Aave, ending with over 420,000 ETH and 18,270 BTC.

    Remediation

    Binance suspended deposits and withdrawals pending security checks, revoked authorizations for the affected address, and is working with blockchain intelligence partners and law enforcement on tracing and recovery. Losses will be covered by the SAFU fund and company funds, with an updated Proof of Reserves to be published after remediation.

30. securityweek.com ↗ · pub. 30/10/2026 05:16 · coletado 30/10 06:00

    $6.3 Billion Binance Heist Attributed to North Korea's TraderTraitor After DevOps Laptop Compromise

    ler a análise desta fonte ocultar

    Binance suffered the largest crypto theft ever recorded, losing roughly $6.3 billion (TRM Labs counts $6.36B) across ten blockchains on October 29, 2026, with most funds moved within about 20 minutes. Binance's initial investigation points to a compromised DevOps engineer's laptop that gave the attacker access to a service container capable of submitting unauthorized withdrawal transactions; no wallet private key leak was found. TRM Labs attributes the attack with high confidence to TraderTraitor, North Korea's elite hacking unit, citing overlaps with the Bybit ($1.5B, Feb 2025) and KelpDAO (April 2026) heists. Chainalysis concurs, noting proceeds from the Bitget exploit mixed with Binance funds, and ZachXBT points to Lazarus Group. Roughly $2.7–3 billion has been frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council, but over 420,000 ETH and 18,270 BTC (~$2.4B) remain unfreezable.

    Technical Details

    • The operator wallet was funded via small Tornado Cash withdrawals; malicious code was trialed on other wallets at least a day and a half in advance.
    • On Ethereum, attackers abused EIP-7702 delegation, submitting a batch of 50 pre-signed permissions from a Binance hot wallet so one would match the wallet's nonce at execution, delegating the wallet to an attacker-controlled contract.
    • On the other nine chains, funds moved via regular, validly signed transactions across different key types and signing schemes within ~30 minutes, leading TRM to assess the attacker gained the ability to make Binance's hot wallet signing system sign arbitrary transactions.
    • Laundering differed from Bybit: instead of cross-chain bridges, attackers used large trades with market makers and lending platforms, dumping USDT for ETH at >10% below market to outrun issuer freezes.

    Remediation

    Binance halted withdrawals and pledged full reimbursement via company funds and the Secure Asset Fund for Users (SAFU). Exchanges should review endpoint hardening for DevOps staff, isolate signing infrastructure from developer workstations, enforce transaction policy controls on hot wallet signers, and monitor for anomalous EIP-7702 delegations.

31. gbhackers.com ↗ · pub. 30/10/2026 03:18 · coletado 30/10 04:00

    Binance halts deposits and withdrawals after breach; estimates of stolen crypto range from $5.7B to $6.3B

    ler a análise desta fonte ocultar

    Binance suspended all deposits and withdrawals following a security incident in which attackers allegedly drained billions in cryptocurrency from internet-connected hot wallets. Early blockchain-tracking estimates put losses at roughly $5.7 billion, with later figures of about $5.9 billion cited by Chainalysis and around $6.3 billion attributed to Binance itself. The exchange stated that user funds remain safe, that it will cover all losses, and that it is working with law enforcement while preparing a full postmortem. Preliminary findings point to a compromised DevOps engineer's laptop that allowed an attacker to reach a service container and submit unauthorized withdrawal transactions, though no completed forensic determination has been published. Frozen assets have risen from $2.54 billion to roughly $3 billion, aided by Tether (over $1.57 billion USDT) and Circle (around $800 million USDC).

    Technical Details

    Binance's preliminary account describes endpoint compromise of a DevOps engineer leading to access to a service container and unauthorized withdrawal submissions from hot wallets. The initial infection method, exploited vulnerability, persistence mechanism and credentials involved have not been disclosed; the article explicitly notes it is unknown whether phishing, malware or another technique was used. Comparisons to the Bybit exchange theft have been made, but no shared attacker or identical exploitation method has been established.

    Remediation

    Binance advises users to rely exclusively on official channels and to ignore unofficial links, messages or requests for account information, as scam activity typically follows such incidents. Deposits and withdrawals remain suspended as a precaution while security checks and asset freezes proceed.

32. thehackernews.com ↗ · pub. 30/10/2026 01:14 · coletado 30/10 03:00

    Binance breach impacts $6.3B in assets; compromised DevOps engineer laptop enabled unauthorized withdrawals

    ler a análise desta fonte ocultar

    Binance disclosed a "security incident" affecting approximately $6.3 billion in assets, with nearly $3 billion frozen on-chain so far. Initial investigation points to a compromised DevOps engineer's laptop, which gave the attacker access to a service container from which unauthorized withdrawal transactions were submitted; Binance says there is no evidence of wallet private key leakage. Tether froze over 1.567 billion USDT, Circle froze 800 million, and the Arbitrum Security Council froze about $30.5 million tied to the exploit. Chainalysis estimates roughly $5.912 billion stolen at the time of theft, nearly 4x the Bybit February 2025 heist (~$1.5B, attributed to North Korea), making it the largest crypto heist on record. Binance will cover losses via its SAFU fund and its own reserves. Story is still developing.

    Technical Details

    • Initial access attributed to a compromised endpoint (DevOps engineer's laptop).
    • Lateral movement into a service container with privileges to submit withdrawal transactions.
    • No private key compromise claimed; abuse of authorized infrastructure paths instead.

    Remediation

    • Binance temporarily suspended deposits and withdrawals pending security checks.
    • Revoked the affected address authorization.
    • Engaged law enforcement and blockchain intelligence partners to trace and recover funds.
    • Stablecoin issuers executed on-chain freezes of attacker-controlled funds.
33. theregister.com ↗ · pub. 30/10/2026 01:22 · coletado 30/10 02:00

    Binance halts trading after DevOps engineer's laptop compromise enables $6.3B in unauthorized transactions

    ler a análise desta fonte ocultar

    Binance paused all trading, deposits and withdrawals after attackers compromised a DevOps engineer's laptop and used the access to submit unauthorized withdrawal transactions. The exchange initially froze $2.5 billion in assets and later raised its at-risk estimate to $6.3 billion, saying the figure could grow as it works with law enforcement, token issuers and blockchain intelligence firms to trace and freeze more funds. Binance says user funds are safe, that it found no evidence of any wallet private key leak, and that it will cover any customer losses. The initial access method is not yet disclosed; phishing or a supply chain compromise of a developer package cannot be ruled out. Binance also warned users to beware of scam links and messages exploiting the incident.

    Technical Details

    Per Binance's own update, the compromised engineer laptop allowed the attacker to reach a service container, from which unauthorized withdrawal transactions were submitted. No private key leakage has been identified. Trading remained suspended at the time of reporting.

    Remediation

    Binance halted trading, deposits and withdrawals, froze assets with partners, and pledged full reimbursement. Users should ignore unofficial links or requests for account information circulating around the incident.

34. techcrunch.com ↗ · pub. 29/10/2026 19:27 · coletado 29/10 21:00

    Binance halts withdrawals after suspected multi-billion dollar hot wallet drain

    ler a análise desta fonte ocultar

    Binance confirmed it is investigating a security incident after users reported funds being drained from the exchange's wallets, and has temporarily suspended withdrawals on multiple networks as a precaution. Crypto watchers estimate at least $2 billion was drained from Binance's hot wallets, with some estimates reaching $5.7 billion, though figures are unconfirmed and the theft may be ongoing. Founder Changpeng Zhao stated on X that the company was likely hacked but expects user funds to be fully covered. Tether froze roughly $1.56 billion and Circle froze about $800 million linked to the incident. Attribution is unknown; if confirmed, this would rank among the largest crypto breaches in history, surpassing the 2025 Bybit theft of $1.4 billion attributed to North Korean actors.

    Technical Details

    The compromise affected internet-connected hot wallets across multiple blockchain networks. Binance has not disclosed the intrusion vector or whether it received any communication from the attackers. In a separate incident the same day, prediction market Polymarket briefly halted trading and withdrawals after a third-party supplier, DebugBear, was compromised, leading to roughly $2 million in user funds stolen — a supply chain style compromise.

    Remediation

    Users should avoid unofficial links, messages or requests for account information, as scam activity typically spikes around such events. Monitor only official Binance channels for updates. Organizations relying on third-party browser/analytics scripts should review the DebugBear supply chain exposure.

35. securityaffairs.com ↗ · pub. 29/10/2026 19:53 · coletado 29/10 21:00

    Binance probes suspicious $5.8B crypto outflows; Tether and Circle freeze ~$1.79B in stablecoins

    ler a análise desta fonte ocultar

    Binance is investigating a potential security incident after large transfers moved from exchange-linked hot wallets on October 29, with on-chain estimates ranging from $3.55 billion (analyst Spreek) to as much as $5.8 billion (Conor Grogan, Coinbase). Tether and Circle froze roughly $1.79 billion in stablecoins tied to the flagged addresses, with Tether CEO Paolo Ardoino later citing more than $1.567 billion in USDT frozen. Binance publicly acknowledged "reports of a potential security issue", said its security teams were investigating and stated that user funds are "completely safe"; co-founder CZ said the activity appeared to be a hack. No technical explanation or confirmed breach has been published, so reported outflows should not be treated as verified losses. Trackers suggest funds moved across Ethereum, Bitcoin and Tron, and some balances were layered through additional wallets.

    Technical Details

    Blockchain records show transfers from Binance-linked hot wallets to a previously unlabeled wallet, involving ETH, stablecoins and other assets, with nearly $900 million subsequently moved onward across other wallets, complicating tracing. Open questions include whether signing keys or credentials were compromised, which internal systems were involved, whether the transfers were authorized, and whether attacker access persists. Centralized stablecoin issuers were able to blacklist addresses at the token-contract level, a control not available for native assets such as BTC or ETH.

    Remediation

    Users should rely solely on official Binance channels, ignore unsolicited links or "account verification" messages, and never share passwords, 2FA codes or wallet seed phrases. Security teams should anticipate a wave of phishing and support-impersonation scams exploiting the incident.

36. bleepingcomputer.com ↗ · pub. 29/10/2026 19:45 · coletado 29/10 21:00 primeiro registro

    Binance investigates suspected hot wallet breach with up to $5.8 billion in crypto moved

    ler a análise desta fonte ocultar

    Cryptocurrency exchange Binance is investigating a potential security incident after billions of dollars in assets were transferred from multiple Binance hot wallets to a newly created Ethereum address. Blockchain intelligence platform Arkham Intelligence is tracking 55 addresses under an entity labeled "binance-hacker-1029" holding roughly $5.78 billion, which would exceed the $1.5 billion Bybit heist of February 2025 as the largest crypto theft on record. Tether froze over $1.567 billion in USDT and Circle froze over $800 million in USDC tied to the incident, totaling more than $2.3 billion. Binance told BleepingComputer that it is actively investigating and that user funds are "completely safe," without confirming whether the transfers were unauthorized. Founder Changpeng Zhao (CZ) said on X the incident appeared to be a hack and expects user funds to be fully covered.

    Technical Details

    According to blockchain analysis shared by crypto journalist StarPlatinum, the hot wallet known as "Binance 14" moved approximately $2.53 billion across 64 tokens, followed 24 seconds later by $174.4 million from a second wallet, and later 780 million USDC from a third wallet, totaling about $3.48 billion. Etherscan labeled the receiving address "Binance Hot Wallet Exploiter 2" with "Exploit" and "Heist" tags. Tracked assets include ~$1.77B USDT, ~$1.44B BTC, ~$876M ETH and ~$823M USDC. The initial access vector and root cause remain unknown; Arkham's $5.78B figure reflects total holdings across tracked wallets, not a confirmed stolen amount.

    Remediation

    Binance warned users to beware of scams, unofficial links, messages, or requests for account information exploiting the news. Stablecoin issuers are coordinating with law enforcement on freezes.