FBI attributes $6.4B Binance heist to North Korea's TraderTraitor

1. Executive summary

On 29 October 2026 attackers moved roughly $6.3 to $6.4 billion in virtual assets out of Binance wallets across ten blockchains, most of it inside about 20 minutes, and the FBI has now publicly attributed the theft to TraderTraitor, the North Korea-aligned group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. Binance's initial investigation points to a compromised DevOps engineer's laptop that gave access to a service container used to submit unauthorised withdrawal transactions, with no evidence of a wallet private key leak. The direct victim is a crypto exchange, not an EMEA bank, so the exposure for our clients is second-order: counterparty and settlement risk where they hold balances or route flows through Binance, and the same intrusion pattern (developer endpoint to signing infrastructure) against their own custody and payment systems. No CVE is associated with this item, no CISA KEV entry applies, and the actor has no MITRE ATT&CK profile in our data, so the attribution is unconfirmed for our purposes despite the FBI statement.

2. Regulatory framing

No other article in the reference is engaged by the facts here.

3. Technical analysis & attack chain

The confirmed sequence, from Binance's own statements and the on-chain tracing by TRM Labs and Chainalysis:

1. Attackers compromised a DevOps engineer's laptop, which Binance names as the likely entry point.
2. From that endpoint they reached a service container and used it to submit unauthorised withdrawal transactions.
3. On Ethereum, 50 EIP-7702 authorisations, all signed in advance by a Binance hot wallet, were sent so that one would match the wallet's transaction count at execution time. The wallet ended up delegated to a contract only the attackers could command.
4. Binance wallets on the other chains, using different key types and signing schemes, all produced valid signatures for the attackers within about half an hour.
5. Roughly $6.36 billion left wallets across ten blockchains, most within about 20 minutes. TRM says staging began at least 36 hours earlier, with test runs moving money between attacker-controlled wallets.
6. The operator wallet was funded with small Tornado Cash withdrawals.

The EIP-7702 detail matters. It lets a standard wallet delegate its behaviour to a smart contract by signing a permission, and pre-signing a batch of 50 lets the attacker pick the one that lines up with the wallet's nonce at the moment of execution. TRM's initial read was that the Ethereum activity looked like phishing, but phishing does not explain the other nine chains, where wallets with different key types and signing schemes all signed validly for the attacker inside half an hour. TRM's assessment, which we regard as the most defensible reading of the public facts, is that the attackers gained the ability to make Binance's hot wallet signing system sign transactions of their choosing across chains. That is a compromise of signing infrastructure, not of a single key.

Laundering differed from the February 2025 Bybit theft. Rather than cross-chain bridges, the attackers mainly used large trades with market makers and lending platforms. By 00:30 UTC on 30 October, TRM tallied about $2.7 billion frozen: roughly 1.77 billion USDT by Tether, about 825 million USDC by Circle, smaller amounts by Ripple and World Liberty Financial, and about $30 million moved out of an attacker wallet by Arbitrum's Security Council using emergency powers. Binance says close to $3 billion frozen. The two figures differ and should be treated as developing estimates. Reports also differ on the number of chains touched (ten in TRM's count, 20 in The Record's), and the stolen total is quoted as $6.3 billion by Binance and $6.36 billion by TRM.

Attribution caveat: the FBI, with the US Secret Service and IRS Criminal Investigation, attributed the theft to TraderTraitor. TRM Labs and Chainalysis reached the same conclusion with high confidence, and ZachXBT named Lazarus Group. Binance has not publicly identified the attackers. None of the six actor names in this item has a MITRE ATT&CK profile in our data, so the attribution is unconfirmed at the level of technique mapping even though it is multi-source at the level of naming. The technical chain above rests on Binance's statements and TRM's tracing; Binance has promised a full technical post-mortem and has not yet published it, so the intrusion path beyond the laptop and service container is not public.

4. Mitigation & containment

P1 (within 24 hours)

• If your institution holds balances on Binance or routes settlement through it, obtain a written status from the exchange on withdrawal resumption, Proof of Reserves and which wallets were affected, and treat the frozen-asset figures as unconfirmed until reconciled.
• Inventory every system where a developer endpoint can reach transaction-signing or withdrawal-submission logic. The Binance path was laptop to service container to withdrawal submission; map the equivalent path in your estate and confirm whether a compromised developer workstation alone can reach it.
• For any EIP-7702 delegation in use on your own custody wallets, review the delegated contract and revoke delegations you cannot account for. Check for batches of pre-signed authorisations against hot wallets.

P2 (within 72 hours)

• Enforce separation between developer environments and signing infrastructure: signing requests should require a second, independent approval path that a service container cannot satisfy on its own.
• Add monitoring for anomalous signing volume and for signatures produced across multiple chains or key types in a short window. Binance's wallets signed validly on ten chains inside about 30 minutes; that pattern is detectable.
• Review third-party contracts with crypto exchanges and custodians against DORA Art. 30 key contractual provisions, specifically loss reimbursement, breach notification timelines and audit rights.

P3 (within 7 days)

• Brief finance and treasury staff on follow-up scams. Malwarebytes notes fake support and fake recovery offers targeting exchange users; the FBI warned in 2023 that fake recovery services target people who have already lost cryptocurrency. No staff member should hand over authentication codes to anyone claiming to help with the incident.
• Where clients or counterparties are Binance users, direct them to official Binance channels only and to check transaction history and security settings directly in the app.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe the intrusion at the level of infrastructure and on-chain mechanics (compromised DevOps laptop, service container, EIP-7702 authorisations, Tornado Cash funding) but publish no hashes, domains, IP addresses or file paths.

6. Detection

Insufficient indicators to author detection rules. The sources give no file artefacts, command lines, registry keys or network indicators to build a rule from, and a rule keyed on actor names or the EIP-7702 mechanism would detect reporting about the incident rather than the intrusion. The behavioural indicators in §5 are the usable detection surface and should be implemented as signing-service and on-chain monitoring logic rather than as static signatures.

7. Sources

• The Hacker News, "FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist", https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html, 2026-11-01
• Cybersecurity Dive, "North Korea-linked group steals $6.3B from Binance in largest-ever cryptocurrency hack", https://www.cybersecuritydive.com/news/binance-hack-north-korea-cryptocurrency-theft/873304/
• SecurityWeek, "$6 Billion Binance Hack Bears Hallmarks of North Korea's TraderTraitor", https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/
• Help Net Security, "Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record", https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/, 2026-10-30
• Malwarebytes Labs, "Binance hit by largest-ever crypto theft, with $6.3 billion stolen", https://www.malwarebytes.com/blog/news/2026/10/binance-hit-by-largest-ever-crypto-theft-with-6-3-billion-stolen
• The Record (Recorded Future), "Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds", https://therecord.media/binance-hit-by-record-6-billion-crypto-hack

8. Adverse Trace position

Adverse Trace assesses this as a high-impact event for the crypto sector and a moderate second-order risk for EMEA financial services clients, driven by counterparty exposure to Binance and by the intrusion pattern rather than by any CVE or KEV entry, of which there are none. The attribution to TraderTraitor is multi-source (FBI, TRM Labs, Chainalysis) but unconfirmed at the technique level because no MITRE ATT&CK profile exists for the actor in our data, and Binance's technical post-mortem is still outstanding, so the intrusion path beyond the DevOps laptop and service container is single-sourced to Binance's initial statement. We will monitor for that post-mortem, for the final frozen-versus-lost reconciliation, and for any change in Binance withdrawal status, and we will issue an update if the post-mortem names specific tooling or indicators that support detection content. Clients with Binance exposure should treat the frozen-asset figures as provisional and confirm their own balances directly with the exchange.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.