Binance hot wallets drained of billions across ten chains; TRM Labs attributes theft to North Korea's TraderTraitor, Binance has not

Linha do tempo

1. hackread.com ↗ · pub. 29/10/2026 23:02 · coletado 01/11 22:21

   Binance investigates suspected crypto hack of up to $5.8B; about $3B frozen, EIP-7702 delegation seen before transfers

   ler a análise desta fonte ocultar

   Binance is investigating a suspected hack after billions of dollars moved out of exchange-associated wallets on October 29, 2026. Outside estimates of the suspicious transfers range from $3.3 billion (Blockaid) to $5.8 billion (Coinbase's Conor Grogan). If the upper figure were confirmed as stolen, it would be the largest publicly reported crypto theft, above the roughly $1.5 billion Bybit theft of February 2025. Binance has not confirmed the amount stolen. It says user funds are "completely safe" and that about $3 billion has been verified as frozen. No attacker has been publicly identified.

   Technical Details

   • Blockaid reported about $3.3B in suspicious outflows across Ethereum, Arbitrum and Avalanche. The estimates come from different stages of the investigation and should not be summed or read as Binance's final loss.
   • Investigators found a signed EIP-7702 authorization 3m24s before the first Ethereum transaction. A Binance-labeled wallet then moved 167,464 ETH plus 63 tokens, including 1.615B USDT.
   • Phylax Systems founder Odysseas Lamtzidi said the delegation could let smart-contract code execute through the wallet and authorize further transfers.
   • How the signature was obtained is unknown. Reporting has not established whether signing credentials or a signing system were compromised, or whether someone was tricked into approving a malicious request. Use of EIP-7702 does not itself indicate a flaw in Ethereum.
   • Circle froze more than 800M USDC tied to the incident, in coordination with law enforcement.
   • The initial compromise may predate the first recorded transfer.
   • The article notes that Bitget reported a hack about a month earlier, with suspected Lazarus Group involvement. It draws no link to the Binance incident.
   • Freezing blocks token transfers but does not mean funds have been returned or define the final recovery.
   • Binance.US said it was unaffected.
   • CZ, who no longer manages Binance, said the activity looked like a hack.

   Remediation

   • Binance is working with law enforcement, token issuers and blockchain intelligence firms to trace and freeze more assets.
   • Customers are told to rely on official Binance announcements and to beware of unofficial links, messages and requests for account information.
2. gbhackers.com ↗ · pub. 30/10/2026 13:57 · coletado 30/10 14:00

   TraderTraitor drains about $6.36B from Binance hot wallets across ten blockchains, the largest crypto theft on record

   ler a análise desta fonte ocultar

   North Korea's TraderTraitor group drained about $6.36 billion from Binance wallets across ten blockchains on 29 October 2026, according to TRM Labs, which calls it the largest crypto theft on record and about four times the $1.5 billion Bybit heist of February 2025. Most funds left within about 20 minutes starting at 20:05 UTC, with a second wave around 23:05 UTC hitting Avalanche and Polygon. Binance suspended withdrawals on several networks and says user funds are safe. Binance has not published a root cause, but the BBC reports a preliminary finding pointing to a compromised engineer's laptop. TRM counts about $2.7 billion frozen, while the attacker still controls over 420,000 ETH and 18,270 BTC (about $2.4 billion).

   Technical Details

   • Preparation began at least 36 hours earlier: an operator wallet received small Tornado Cash withdrawals on 28 October, the attacker tested its code on two wallets, rehearsed on a third, and about four hours later installed the same code on a Binance hot wallet.
   • On Ethereum, a single transaction at 20:20 UTC carried 50 EIP-7702 authorizations signed by the Binance hot wallet, delegating it to a sweeper contract that accepted instructions only from the operator. The 50 consecutive nonces guaranteed one signature would remain valid as the wallet's nonce advanced.
   • About 3 min 24 s later the operator moved 167,464 ETH and 63 tokens, including 1.615 billion USDT. The delegation stayed active, so new deposits were swept again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.
   • The other nine chains (including XRP Ledger, Bitcoin, Tron and Solana) used ordinary signed transfers. Despite different key types and signing schemes, all produced valid signatures within about 30 minutes. TRM assesses the attacker could make Binance's hot wallet signing system sign transactions of its choosing.
   • Attribution rests on patterns from earlier heists: Tornado Cash funding, early staging, and pre-obtained signatures executed in one burst, matching the Bybit and KelpDAO attacks.
   • Freezes: Tether about 1.77B USDT, Circle about 825M USDC, Ripple 40.5M RLUSD, World Liberty Financial 27.8M USD1. Arbitrum's Security Council moved 8,426 ETH and 74.6M ARB (about $30M) out of the attacker's reach.
   • The attacker raced the freezes, selling about 325M USDT to market makers for roughly 122,300 ETH at a discount above 10%, and borrowing about 19,760 ETH against USDT on Aave. BTC is moving through a peel chain; TRM expects bridges, swap services and OTC brokers next.

   Remediation

   • Screen deposits and counterparties against labeled attacker addresses; market makers and solvers should screen counterparties before filling large orders.
   • Alert on any EIP-7702 delegation on treasury wallets and reject unexpected authorizations; treat requests for many authorizations across a range of nonces as a compromise indicator.
   • Keep a pre-approved revocation method ready.
   • Separate signing infrastructure and approval paths by chain and wallet tier.
   • The investigation is ongoing and figures may change.
3. techcrunch.com ↗ · pub. 29/10/2026 19:27 · coletado 29/10 21:00

   Binance halts withdrawals after suspected multi-billion dollar hot wallet drain

   ler a análise desta fonte ocultar

   Binance confirmed it is investigating a security incident after users reported funds being drained from the exchange's wallets, and has temporarily suspended withdrawals on multiple networks as a precaution. Crypto watchers estimate at least $2 billion was drained from Binance's hot wallets, with some estimates reaching $5.7 billion, though figures are unconfirmed and the theft may be ongoing. Founder Changpeng Zhao stated on X that the company was likely hacked but expects user funds to be fully covered. Tether froze roughly $1.56 billion and Circle froze about $800 million linked to the incident. Attribution is unknown; if confirmed, this would rank among the largest crypto breaches in history, surpassing the 2025 Bybit theft of $1.4 billion attributed to North Korean actors.

   Technical Details

   The compromise affected internet-connected hot wallets across multiple blockchain networks. Binance has not disclosed the intrusion vector or whether it received any communication from the attackers. In a separate incident the same day, prediction market Polymarket briefly halted trading and withdrawals after a third-party supplier, DebugBear, was compromised, leading to roughly $2 million in user funds stolen — a supply chain style compromise.

   Remediation

   Users should avoid unofficial links, messages or requests for account information, as scam activity typically spikes around such events. Monitor only official Binance channels for updates. Organizations relying on third-party browser/analytics scripts should review the DebugBear supply chain exposure.

4. securityaffairs.com ↗ · pub. 29/10/2026 19:53 · coletado 29/10 21:00

   Binance probes suspicious $5.8B crypto outflows; Tether and Circle freeze ~$1.79B in stablecoins

   ler a análise desta fonte ocultar

   Binance is investigating a potential security incident after large transfers moved from exchange-linked hot wallets on October 29, with on-chain estimates ranging from $3.55 billion (analyst Spreek) to as much as $5.8 billion (Conor Grogan, Coinbase). Tether and Circle froze roughly $1.79 billion in stablecoins tied to the flagged addresses, with Tether CEO Paolo Ardoino later citing more than $1.567 billion in USDT frozen. Binance publicly acknowledged "reports of a potential security issue", said its security teams were investigating and stated that user funds are "completely safe"; co-founder CZ said the activity appeared to be a hack. No technical explanation or confirmed breach has been published, so reported outflows should not be treated as verified losses. Trackers suggest funds moved across Ethereum, Bitcoin and Tron, and some balances were layered through additional wallets.

   Technical Details

   Blockchain records show transfers from Binance-linked hot wallets to a previously unlabeled wallet, involving ETH, stablecoins and other assets, with nearly $900 million subsequently moved onward across other wallets, complicating tracing. Open questions include whether signing keys or credentials were compromised, which internal systems were involved, whether the transfers were authorized, and whether attacker access persists. Centralized stablecoin issuers were able to blacklist addresses at the token-contract level, a control not available for native assets such as BTC or ETH.

   Remediation

   Users should rely solely on official Binance channels, ignore unsolicited links or "account verification" messages, and never share passwords, 2FA codes or wallet seed phrases. Security teams should anticipate a wave of phishing and support-impersonation scams exploiting the incident.

5. bleepingcomputer.com ↗ · pub. 29/10/2026 19:45 · coletado 29/10 21:00 primeiro registro

   Binance investigates suspected hot wallet breach with up to $5.8 billion in crypto moved

   ler a análise desta fonte ocultar

   Cryptocurrency exchange Binance is investigating a potential security incident after billions of dollars in assets were transferred from multiple Binance hot wallets to a newly created Ethereum address. Blockchain intelligence platform Arkham Intelligence is tracking 55 addresses under an entity labeled "binance-hacker-1029" holding roughly $5.78 billion, which would exceed the $1.5 billion Bybit heist of February 2025 as the largest crypto theft on record. Tether froze over $1.567 billion in USDT and Circle froze over $800 million in USDC tied to the incident, totaling more than $2.3 billion. Binance told BleepingComputer that it is actively investigating and that user funds are "completely safe," without confirming whether the transfers were unauthorized. Founder Changpeng Zhao (CZ) said on X the incident appeared to be a hack and expects user funds to be fully covered.

   Technical Details

   According to blockchain analysis shared by crypto journalist StarPlatinum, the hot wallet known as "Binance 14" moved approximately $2.53 billion across 64 tokens, followed 24 seconds later by $174.4 million from a second wallet, and later 780 million USDC from a third wallet, totaling about $3.48 billion. Etherscan labeled the receiving address "Binance Hot Wallet Exploiter 2" with "Exploit" and "Heist" tags. Tracked assets include ~$1.77B USDT, ~$1.44B BTC, ~$876M ETH and ~$823M USDC. The initial access vector and root cause remain unknown; Arkham's $5.78B figure reflects total holdings across tracked wallets, not a confirmed stolen amount.

   Remediation

   Binance warned users to beware of scams, unofficial links, messages, or requests for account information exploiting the news. Stablecoin issuers are coordinating with law enforcement on freezes.