Researchers Say North Korea’s TraderTraitor Likely Behind $6.3 Billion Binance Heist
Summary
TRM Labs estimates $6.36 billion was taken from Binance wallets across 10 blockchains on Oct. 29. Researchers point to North Korea’s TraderTraitor; Binance says its early investigation suggests a compromised employee laptop, with no evidence of leaked wallet keys.
Key points
- TRM Labs traced about $6.36 billion from Binance wallets across 10 blockchains on Oct. 29; most of the funds moved within roughly 20 minutes.
- Binance halted withdrawals and pledged to reimburse losses using company funds and its Secure Asset Fund for Users.
- Binance’s preliminary investigation suggests a compromised DevOps engineer’s laptop may have enabled access to a service container and unauthorized withdrawals; the exchange says it found no evidence of a wallet private-key leak.
- On Ethereum, attackers reportedly used 50 pre-signed EIP-7702 permissions to delegate a Binance hot wallet to a contract under their control.
- TRM says valid signatures across the other nine blockchains suggest the attacker may have been able to direct Binance’s hot-wallet signing system.
- TRM attributes the attack to North Korea’s TraderTraitor with high confidence; Chainalysis also considers the group the likely perpetrator. These are assessments, and Binance has not publicly identified the hackers.
- By 00:30 UTC on Oct. 30, TRM counted about $2.7 billion in frozen assets; it said the attackers still held assets worth about $2.4 billion that issuers could not freeze.
Article Details
- Victim Organization
- Binance
- Incident Type
- Cryptocurrency theft involving unauthorized withdrawal transactions from Binance wallets across ten blockchains.
- Incident Date
- 2026-10-29
- Operational Impact
- Binance halted withdrawals and pledged to reimburse losses. Binance estimated approximately $3 billion in assets had been frozen; TRM reported approximately $2.7 billion frozen by 00:30 UTC on October 30.
- Claim Status
- confirmed
People
Threat Actors
Jade SleetTRM attributed the Binance attack to TraderTraitor with high confidence. Chainalysis also assessed TraderTraitor as the likely perpetrator. Binance had not publicly identified the hackers.Lazarus GroupZachXBT named Lazarus Group as the probable attacker; this is an attributed assessment, not a confirmed identification by Binance.