> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Binance freezes $3B in assets following $6.3B security breach - URL: https://f4n6.co.uk/security-feed/binance-freezes-3b-in-assets-following-6-3b-security-breach/ - Published: 2026-10-30T09:44:27.000Z - Updated: 2026-10-30T09:44:27.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Binance has reported a security incident affecting about $6.3 billion in assets, with close to $3 billion frozen on-chain so far. Binance's initial investigation points to a compromised DevOps engineer's laptop that gave an attacker access to a service container and the ability to submit unauthorised withdrawal transactions. TRM Labs and Chainalysis both attribute the theft with high confidence to TraderTraitor, the North Korean group the FBI named in the February 2025 Bybit hack; Binance has not publicly identified the attackers. No CVE has been assigned and there is no CISA KEV entry, so this is an operational and third-party risk event rather than a patchable vulnerability. For EMEA financial services the exposure is indirect but concrete: firms holding crypto assets, running exchange settlement or custody through third-party providers, or accepting stablecoin flows need to confirm whether Binance is in their transaction path and whether their own withdrawal authorisation controls would survive a compromised engineer endpoint. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk, general principles | Binance is a third-party ICT provider in the settlement or custody path for any client holding or transacting crypto through it, and the incident is a failure at that provider. | Clients must confirm contractual and risk-register coverage for this provider and record the incident against the third-party risk process. | | DORA Art. 29: preliminary assessment of ICT concentration risk | The affected assets sit on ten blockchains and the freeze depended on a small set of stablecoin issuers (Tether, Circle, Ripple, World Liberty Financial) and Arbitrum's Security Council acting together. | Clients with exposure concentrated in the same issuers, chains or a single exchange should reassess concentration now, not at the next scheduled review. | | NIS2 Art. 21(2)(d): supply chain security measures | The entry point was an employee laptop at the provider, and the signing infrastructure that authorised withdrawals across chains was compromised. | Supply chain measures should extend to the provider's endpoint and signing controls, not just its stated security posture. | ## 3\. Technical analysis & attack chain The confirmed sequence, from Binance's own statements and on-chain tracing by TRM Labs: 1. An attacker compromised a Binance DevOps engineer's laptop. Binance has not said how the laptop was compromised. 2. From that endpoint the attacker reached a service container and submitted unauthorised withdrawal transactions. 3. On Ethereum, the attacker used EIP-7702, which lets a standard wallet delegate its behaviour to a smart contract by signing a permission. The attacker sent a batch of 50 such permissions, all signed in advance by a Binance hot wallet, so that one would match the wallet's transaction count at execution time. The wallet ended up delegated to a contract only the attackers could command, which they used to empty it. 4. Binance wallets on the other nine blockchains, using different key types and signing schemes, all produced valid signatures for the attacker within about half an hour. TRM's assessment is that this indicates compromise of Binance's hot wallet signing infrastructure rather than phishing alone. 5. About $6.36 billion left Binance wallets across ten blockchains on 29 October, most of it within roughly 20 minutes. TRM says the attackers spent at least a day and a half preparing: the operator wallet was funded with a few small Tornado Cash withdrawals, and the malicious code was trialled on other wallets before going live. 6. Binance found no evidence of a wallet private key leak. It revoked the affected address authorisation, halted trading, deposits and withdrawals, and brought in law enforcement and blockchain intelligence partners. Deposits were later restored; withdrawals stay paused until a security revamp of the withdrawal service and its related addresses completes, with resumption expected within 48 hours. The freeze is the part that matters for defenders. Tether froze more than 1.567 billion USDT and Circle more than 800 million USDC, both in coordination with law enforcement. Ripple and World Liberty Financial froze smaller amounts, and Arbitrum's Security Council used emergency powers to move about $30 million out of an attacker wallet. TRM put total frozen assets at around $2.7 billion by 00:30 UTC on 30 October. The hackers still hold more than 420,000 ETH and 18,270 BTC. Laundering has so far relied mainly on large trades with market makers and on lending platforms rather than cross-chain bridges, which is a departure from the Bybit case. Attribution and confidence. TRM Labs attributes the attack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence and shared traits with the Bybit heist and the April 2026 KelpDAO hack: a mixer-funded operator wallet, long preparation, and signatures collected ahead of time and used at once. Chainalysis reached the same conclusion, citing ties to an earlier hack and proceeds from last month's Bitget exploit mixed with funds taken from Binance. ZachXBT also named the Lazarus Group. This is multi-source but all of it is vendor assessment; Binance itself has not named the attackers. Treat the attribution as high-confidence but not confirmed by the victim or by law enforcement. Unconfirmed detail. Binance has not explained how the laptop was compromised. The Register notes that phishing or a supply chain attack on a developer package cannot be ruled out. Binance says it will publish a technical post-mortem once the investigation is complete. No atomic indicators (hashes, domains, IPs, filenames) have been published by any source. ## 4\. Mitigation & containment P1 within 24 hours - Confirm whether Binance sits anywhere in your transaction, settlement or custody path, directly or through a fund or counterparty. If it does, suspend new withdrawal instructions to Binance addresses until Binance confirms the withdrawal service revamp is complete. - Pull your own withdrawal authorisation model. The failure here was that pre-signed permissions and cross-chain signing were all honoured without a control that could stop them. If your treasury or custody platform accepts pre-signed transactions or delegated wallet permissions (EIP-7702 or equivalent), require human re-approval at execution time rather than at signing time. - Check whether you hold USDT, USDC or assets on Arbitrum and whether any address you control is on the frozen list. Contact the issuer or your custodian to confirm status before attempting transfers. P2 within 72 hours - Review endpoint controls on engineering and DevOps staff who hold access to signing or withdrawal systems. The entry point was a developer laptop; require that such endpoints cannot reach production signing services without a separate authenticated jump path. - Ask any third-party provider with Binance exposure for its own incident assessment and for confirmation of which of your assets were in scope. P3 within 7 days - Update the third-party risk register entry for Binance and for the stablecoin issuers, and record the concentration assessment required under DORA Art. 29. - Re-test your incident escalation path against a scenario where a provider's signing infrastructure, not its private keys, is compromised. The controls that detect key theft will not catch this. ## 5\. Indicators of compromise No indicators of compromise available in the source material. No hashes, domains, IPs, filenames or command lines have been published by Binance, TRM Labs, Chainalysis or the reporting outlets. The sources do describe observable behaviours. These are not atomic indicators and are not for machine enforcement. ### Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------- | -------------------------- | | EIP-7702 delegation permissions signed in advance by a hot wallet, batched (50 in this case) to match transaction count at execution | Ethereum transaction logs; wallet authorisation events | high (TRM Labs tracing) | | Valid signatures produced across ten blockchains with different key types and signing schemes within about 30 minutes | Cross-chain signing service logs; HSM or signing infrastructure audit trail | high (TRM Labs assessment) | | Operator wallet funded by small Tornado Cash withdrawals before the theft | On-chain funding traces | high (TRM Labs) | | Test transactions against other wallets before the live run | On-chain activity in the preparation window | medium (TRM Labs) | | Proceeds laundered through large market-maker trades and lending platforms rather than bridges | Exchange and lending platform flow analysis | medium (TRM Labs) | ## 6\. Detection Insufficient indicators to author detection rules. No artefact of the threat itself (file strings, command lines, mutexes, registry keys, filenames) appears in any source. A rule built on the actor name, the EIP-7702 mechanism or the exchange name would detect reporting about the incident, not the activity. The behavioural indicators in §5 are the usable material, and they belong in on-chain monitoring and signing-service audit alerting rather than in YARA or Sigma. ## 7\. Sources - The Hacker News, "Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen", 2026-10-30\. https://thehackernews.com/2026/10/binance-suffers-security-breach.html - The Register, "In the year AI re-wrote the infosec rulebook, it's comforting to know crypto exchanges still have bad security", 2026-10-30\. https://www.theregister.com/security/2026/10/30/in-the-year-ai-re-wrote-the-infosec-rulebook-its-comforting-to-know-crypto-exchanges-still-have-bad-security/5306539 - Help Net Security, "Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record", 2026-10-30\. https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/ - SecurityWeek, "$6 Billion Binance Hack Bears Hallmarks of North Korea's TraderTraitor", 2026-10-30\. https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/ ## 8\. Adverse Trace position Adverse Trace assesses this as a high-impact third-party incident with no direct technical exposure for most EMEA financial services clients, and no CVE or CISA KEV entry to drive patching. The attribution to TraderTraitor is high-confidence on TRM Labs and Chainalysis assessment but is not confirmed by Binance or by law enforcement, and we treat it as unconfirmed for reporting purposes. The figure at risk has moved during the day ($2.5 billion frozen, then $6.3 billion at risk, then around $2.7 billion frozen by 00:30 UTC), so clients should not rely on any single number. We will monitor Binance's promised technical post-mortem and any law enforcement attribution, and we will issue a follow-up if the post-mortem names the initial access vector or publishes indicators. Clients with Binance in their settlement or custody path should contact us before resuming withdrawal instructions. --- [Read the original source →](https://thehackernews.com/2026/10/binance-suffers-security-breach.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*