EN PT-BR
← Voltar ao feed
critical cryptocurrency financial services

TraderTraitor drains about $6.36B from Binance hot wallets across ten blockchains, the largest crypto theft on record

1 fonte(s) · 1 atualização(ões) · publicado 30/10/2026 13:57 · coletado há 2 dias

North Korea's TraderTraitor group drained about $6.36 billion from Binance wallets across ten blockchains on 29 October 2026, according to TRM Labs, which calls it the largest crypto theft on record and about four times the $1.5 billion Bybit heist of February 2025. Most funds left within about 20 minutes starting at 20:05 UTC, with a second wave around 23:05 UTC hitting Avalanche and Polygon. Binance suspended withdrawals on several networks and says user funds are safe. Binance has not published a root cause, but the BBC reports a preliminary finding pointing to a compromised engineer's laptop. TRM counts about $2.7 billion frozen, while the attacker still controls over 420,000 ETH and 18,270 BTC (about $2.4 billion).

Detalhes técnicos

  • Preparation began at least 36 hours earlier: an operator wallet received small Tornado Cash withdrawals on 28 October, the attacker tested its code on two wallets, rehearsed on a third, and about four hours later installed the same code on a Binance hot wallet.
  • On Ethereum, a single transaction at 20:20 UTC carried 50 EIP-7702 authorizations signed by the Binance hot wallet, delegating it to a sweeper contract that accepted instructions only from the operator. The 50 consecutive nonces guaranteed one signature would remain valid as the wallet's nonce advanced.
  • About 3 min 24 s later the operator moved 167,464 ETH and 63 tokens, including 1.615 billion USDT. The delegation stayed active, so new deposits were swept again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.
  • The other nine chains (including XRP Ledger, Bitcoin, Tron and Solana) used ordinary signed transfers. Despite different key types and signing schemes, all produced valid signatures within about 30 minutes. TRM assesses the attacker could make Binance's hot wallet signing system sign transactions of its choosing.
  • Attribution rests on patterns from earlier heists: Tornado Cash funding, early staging, and pre-obtained signatures executed in one burst, matching the Bybit and KelpDAO attacks.
  • Freezes: Tether about 1.77B USDT, Circle about 825M USDC, Ripple 40.5M RLUSD, World Liberty Financial 27.8M USD1. Arbitrum's Security Council moved 8,426 ETH and 74.6M ARB (about $30M) out of the attacker's reach.
  • The attacker raced the freezes, selling about 325M USDT to market makers for roughly 122,300 ETH at a discount above 10%, and borrowing about 19,760 ETH against USDT on Aave. BTC is moving through a peel chain; TRM expects bridges, swap services and OTC brokers next.

Remediação

  • Screen deposits and counterparties against labeled attacker addresses; market makers and solvers should screen counterparties before filling large orders.
  • Alert on any EIP-7702 delegation on treasury wallets and reject unexpected authorizations; treat requests for many authorizations across a range of nonces as a compromise indicator.
  • Keep a pre-approved revocation method ready.
  • Separate signing infrastructure and approval paths by chain and wallet tier.
  • The investigation is ongoing and figures may change.

Linha do tempo

  1. gbhackers.com ↗ · pub. 30/10/2026 13:57 · coletado 30/10 14:00 primeiro registro

    TraderTraitor drains about $6.36B from Binance hot wallets across ten blockchains, the largest crypto theft on record

    ler a análise desta fonte

    North Korea's TraderTraitor group drained about $6.36 billion from Binance wallets across ten blockchains on 29 October 2026, according to TRM Labs, which calls it the largest crypto theft on record and about four times the $1.5 billion Bybit heist of February 2025. Most funds left within about 20 minutes starting at 20:05 UTC, with a second wave around 23:05 UTC hitting Avalanche and Polygon. Binance suspended withdrawals on several networks and says user funds are safe. Binance has not published a root cause, but the BBC reports a preliminary finding pointing to a compromised engineer's laptop. TRM counts about $2.7 billion frozen, while the attacker still controls over 420,000 ETH and 18,270 BTC (about $2.4 billion).

    Technical Details

    • Preparation began at least 36 hours earlier: an operator wallet received small Tornado Cash withdrawals on 28 October, the attacker tested its code on two wallets, rehearsed on a third, and about four hours later installed the same code on a Binance hot wallet.
    • On Ethereum, a single transaction at 20:20 UTC carried 50 EIP-7702 authorizations signed by the Binance hot wallet, delegating it to a sweeper contract that accepted instructions only from the operator. The 50 consecutive nonces guaranteed one signature would remain valid as the wallet's nonce advanced.
    • About 3 min 24 s later the operator moved 167,464 ETH and 63 tokens, including 1.615 billion USDT. The delegation stayed active, so new deposits were swept again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.
    • The other nine chains (including XRP Ledger, Bitcoin, Tron and Solana) used ordinary signed transfers. Despite different key types and signing schemes, all produced valid signatures within about 30 minutes. TRM assesses the attacker could make Binance's hot wallet signing system sign transactions of its choosing.
    • Attribution rests on patterns from earlier heists: Tornado Cash funding, early staging, and pre-obtained signatures executed in one burst, matching the Bybit and KelpDAO attacks.
    • Freezes: Tether about 1.77B USDT, Circle about 825M USDC, Ripple 40.5M RLUSD, World Liberty Financial 27.8M USD1. Arbitrum's Security Council moved 8,426 ETH and 74.6M ARB (about $30M) out of the attacker's reach.
    • The attacker raced the freezes, selling about 325M USDT to market makers for roughly 122,300 ETH at a discount above 10%, and borrowing about 19,760 ETH against USDT on Aave. BTC is moving through a peel chain; TRM expects bridges, swap services and OTC brokers next.

    Remediation

    • Screen deposits and counterparties against labeled attacker addresses; market makers and solvers should screen counterparties before filling large orders.
    • Alert on any EIP-7702 delegation on treasury wallets and reject unexpected authorizations; treat requests for many authorizations across a range of nonces as a compromise indicator.
    • Keep a pre-approved revocation method ready.
    • Separate signing infrastructure and approval paths by chain and wallet tier.
    • The investigation is ongoing and figures may change.