cyber.hendryadrian.com
Cyber Attack & Data Breach · socradar.io

Binance Hot-Wallet Breach Drained an Estimated $6.3 Billion Across 10 Blockchains

· Original article ↗

Summary

Binance says attackers used its hot-wallet signing infrastructure to move an estimated $6.3 billion across about 10 blockchains on Oct. 29, 2026. The FBI attributed the theft to North Korea’s TraderTraitor; Binance says it found no evidence of leaked private keys.

Key points

  • Binance confirmed unauthorized hot-wallet withdrawals on Oct. 29, 2026, with its estimated impact around $6.3 billion across about 10 blockchains.
  • Binance’s investigation linked the operation to a tampered installer, a fake job interview with a malicious code repository, and abuse of an internal AI tool to reach its wallet signing service.
  • On Ethereum, a transaction used 50 authorizations signed by a Binance hot wallet to direct funds to an attacker-controlled sweeper contract.
  • Binance says it found no evidence of leaked wallet private keys, but its investigation identified additional points of breach.
  • The FBI attributed the theft to North Korea’s TraderTraitor. Binance has not publicly named the attacker.
  • Binance reported about $3 billion frozen on-chain and said it would cover losses; its Nov. 4 update said about 98% of the impacted amount had been replenished.
  • Withdrawals resumed in phases, with some assets still paused in the article’s latest update; deposits were unaffected.

Article Details

Victim Organization
Binance
Incident Type
Hot-wallet compromise and unauthorized multi-chain cryptocurrency withdrawals through Binance’s signing infrastructure.
Incident Date
2026-10-29
Disclosure Date
2026-10-29
Data Types Exposed
  • Cryptocurrency assets stolen, including ETH, USDT, BTC, XRP and other tokens
Affected Data Size
Approximately $6.3 billion in cryptocurrency assets by Binance’s estimate; independent estimates ranged from $6.36 billion to $6.4 billion.
Operational Impact
Unauthorized withdrawals affected about 10 blockchains, with the main outflows occurring in roughly 20 minutes. Binance paused withdrawals while it investigated and rebuilt the withdrawal service, then restored them in phases beginning November 1, 2026. Deposits were unaffected. About $3 billion was reported frozen on-chain.
Ransom Or Extortion
Unknown
Claim Status
confirmed

People

Richard TengBinance co-CEO who publicly discussed the attack, recovery measures, and the attacker’s reported use of a self-destruct mechanism.Yi HeBinance co-CEO who stated that withdrawals remained paused while the company improved controls on the withdrawal service.

Threat Actors

Jade SleetThe FBI attributed the theft to North Korea’s TraderTraitor in an October 31, 2026 statement. Blockchain analytics firms had also linked the theft to the group, though Binance did not name the attacker.

Countries

North Korea[Update] November 2, 2026: FBI Attributes Binance Hack to North Korea’s TraderTraitor

Related Articles