Binance Estimates $6.3 Billion Impact From Hot-Wallet Attack
Summary
Binance says an October 29 hot-wallet incident across at least ten blockchains had an estimated $6.3 billion impact. Initial findings suggest a compromised DevOps laptop may have enabled access to a withdrawal system; TRM Labs attributes the attack to TraderTraitor, un1
Key points
- Binance estimated the incident’s impact at about $6.3 billion after funds moved from hot wallets across at least ten blockchains on October 29.
- Binance paused deposits and withdrawals, said user funds were safe, and pledged to cover losses.
- Initial Binance findings suggest an attacker may have compromised a DevOps engineer’s laptop and used it to access an internal withdrawal-submission service; full technical details are pending.
- Binance said there was no evidence that a private key leaked. The article reports no sign that the attackers broke blockchain cryptography or exploited a blockchain flaw.
- TRM Labs attributed the attack, with high confidence, to TraderTraitor, a North Korean hacking unit linked to Lazarus Group; Binance has not attributed the attack, and the claim is not officially confirmed.
- The article recommends least privilege, separation of duties, protected admin devices, and monitoring as defenses against misuse of systems authorized to move funds.
Article Details
- Victim Organization
- Binance
- Incident Type
- Cryptocurrency theft from hot wallets. Binance's initial investigation suggests an attacker compromised a DevOps engineer's laptop and used it to access an internal service for submitting withdrawals; full technical details have not been published.
- Incident Date
- 2026-10-29
- Affected Data Size
- Approximately $6.3 billion in crypto assets, according to Binance's estimate.
- Operational Impact
- Binance paused deposits and withdrawals. The article also reports that crypto prices fell sharply.
- Claim Status
- confirmed
Threat Actors
Jade SleetTRM Labs attributed the Binance attack to TraderTraitor with high confidence. Binance has not officially confirmed the attribution.Lazarus GroupThe article describes TraderTraitor, which TRM Labs attributed the attack to, as linked to Lazarus Group; it does not confirm Lazarus Group's involvement in this incident.