> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# TraderTraitor steals $6.3B from Binance via compromised DevOps laptop
- URL: https://f4n6.co.uk/security-feed/tradertraitor-steals-6-3b-from-binance-via-compromised-devops-laptop/
- Published: 2026-10-30T09:45:53.000Z
- Updated: 2026-10-30T09:45:53.000Z
- Author: Jeff Davies
- Tags: #security-feed, TraderTraitor

## 1\. Executive summary

Binance has disclosed a theft of roughly $6.3 billion in cryptocurrency across ten blockchains, the largest crypto heist on record and about four times the February 2025 Bybit loss. Binance's initial finding is that a compromised DevOps engineer's laptop gave an attacker access to a service container used to submit unauthorised withdrawal transactions; the exchange says it found no wallet private key leak. TRM Labs and Chainalysis both attribute the theft to TraderTraitor, the North Korean group the FBI named in the Bybit hack, but no MITRE ATT&CK profile exists for that name and the attribution is unconfirmed. Roughly $2.7 billion has been frozen on-chain by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council, leaving more than 420,000 ETH and 18,270 BTC (about $2.4 billion) in attacker hands. No CVE is associated with this item and no CISA KEV entry applies; the exposure for EMEA financial services is counterparty and settlement risk through crypto exposure, plus the withdrawal-signing architecture weakness the incident exposes.

## 2\. Regulatory framing

| Article                                                        | Trigger (the fact in this item)                                                                                                                                                         | Practical impact                                                                                                                                                                                                                              |
| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles         | EMEA firms with crypto exposure or custody arrangements depend on Binance and on stablecoin issuers (Tether, Circle) whose freeze actions determined how much of the loss was contained | Third-party risk files for exchange and stablecoin counterparties need the incident, the freeze timeline and Binance's remediation status recorded, and contractual notification expectations checked against what Binance actually disclosed |
| DORA Art. 29: preliminary assessment of ICT concentration risk | The loss ran across ten blockchains and multiple signing schemes from a single exchange's hot wallet infrastructure, and containment depended on a small set of stablecoin issuers      | Firms holding or settling through a single exchange or a single stablecoin issuer should document that concentration and the freeze dependency it creates                                                                                     |
| NIS2 Art. 21(2)(d): supply chain security measures             | Binance's stated entry point is an employee laptop reaching a service container that submits withdrawals, a supplier-side access path into a critical signing function                  | Entities in NIS2 scope that connect to exchange or custody providers should review supplier access paths into transaction-authorisation systems, not just the provider's public statements                                                    |

## 3\. Technical analysis & attack chain

Confirmed steps, from Binance's own statements and on-chain analysis by TRM Labs:

1. An attacker compromised a Binance DevOps engineer's laptop. Binance has not said how.
2. From that laptop the attacker reached a service container and used it to submit unauthorised withdrawal transactions.
3. On Ethereum, 50 EIP-7702 authorisations, all signed in advance by a Binance hot wallet, were submitted as a batch so that one would match the wallet's transaction count at execution time. The wallet ended up delegated to a contract only the attackers could command, which they used to empty it.
4. Binance wallets on the other nine chains, using different key types and signing schemes, produced valid signatures for the attacker within about half an hour.
5. About $6.36 billion left Binance wallets on ten blockchains on October 29, most of it within roughly 20 minutes.
6. Binance revoked the affected address authorisation, paused withdrawals, and brought in law enforcement and blockchain intelligence partners. Deposits resumed; withdrawals were to stay paused until a security revamp of the withdrawal service and its related addresses completed, expected within 48 hours.

The signing infrastructure is the part that matters. TRM's assessment is that the cross-chain pattern, valid signatures from different key types and schemes inside half an hour, indicates compromise of Binance's hot wallet signing infrastructure rather than phishing of individual keys. Phishing would explain the Ethereum activity but not the other nine chains. Binance's own account, a laptop reaching a container that submits withdrawals, is consistent with control of the submission path rather than the keys, and Binance states it found no evidence of a private key leak.

TRM's on-chain preparation detail: the operator wallet was funded with a few small Tornado Cash withdrawals, and the malicious code was trialled on other wallets before going live. TRM says the attackers spent at least a day and a half preparing. Laundering so far has used large trades with market makers and lending platforms rather than the cross-chain bridges seen in Bybit; TRM expects the remaining 420,000 ETH and 18,270 BTC to move through cross-chain bridges, swap services and over-the-counter brokers next.

Attribution and confidence. TRM attributes the attack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence and shared traits with the Bybit heist and the April 2026 KelpDAO hack: a mixer-funded operator wallet, long preparation, and signatures collected ahead of time and used at once. Chainalysis reached the same conclusion, citing mixing of Bitget exploit proceeds with Binance funds. Blockchain sleuth ZachXBT named Lazarus Group. Binance has not publicly identified the attackers. The attribution rests on two blockchain-analytics vendors and one independent researcher, not on government confirmation, and TraderTraitor has no MITRE ATT&CK profile, so no technique mapping is offered here. Treat the DPRK link as the leading assessment, not an established fact.

Single-sourced detail. The EIP-7702 mechanism, the 50 pre-signed authorisations, the Tornado Cash funding and the market-maker laundering pattern come from TRM Labs alone. SecurityWeek and Help Net Security both carry TRM's account, but they are reporting the same firm's analysis, not corroborating it independently. Verify against Binance's promised post-mortem when it is published.

Discrepancy. TRM's figure is $6.36 billion across ten blockchains; Binance states about $6.3 billion; Chainalysis's CEO cited $6.4 billion. The differences are rounding and timing of the on-chain count, not a dispute over the event.

## 4\. Mitigation & containment

### P1 within 24 hours

- Screen all incoming deposits and counterparty transfers against the addresses TRM has tied to the theft, as TRM advises. Obtain that address list from TRM directly; this advisory does not reproduce it.
- If your firm holds crypto on Binance or routes settlement through it, confirm withdrawal status directly with the exchange rather than relying on the 48-hour public estimate, and reconcile balances against your own records.
- Check whether any stablecoin balance you hold was affected by the Tether (1.567 billion USDT) or Circle (800 million USDC) freezes, and get written confirmation from the issuer on the status of your specific holdings.
- Suspend any automated withdrawal or transfer integration that relies on Binance API credentials until Binance confirms the withdrawal service revamp is complete, and rotate those API keys.

### P2 within 72 hours

- Review your own withdrawal-authorisation architecture against the pattern here: if a single engineer's endpoint can reach a service that submits signed transactions, that path needs a second approval step and network segmentation away from developer workstations. This applies to any custody or payment-signing system, not only crypto.
- For firms using EIP-7702 delegation on any wallet, audit active delegations and revoke any the business does not recognise. EIP-7702 lets a wallet delegate its behaviour to a contract by signing a permission; a pre-signed batch is how this attack took the Ethereum hot wallet.
- Require hardware-backed signing for hot wallet operations and remove the ability to pre-sign batches of authorisations for later execution. Pre-signed authorisations that wait for a matching transaction count defeat the point of signing at the time of the transaction.
- Add the incident to third-party risk records for Binance, Tether and Circle, and record the freeze dependency identified in §2.

### P3 within 7 days

- Where your firm is in NIS2 or DORA scope and uses exchange or custody providers, extend supplier access review to the provider's transaction-authorisation systems, not just its public security posture.
- Monitor Binance's promised technical post-mortem and Proof of Reserves update, and revise this assessment when they land.
- Brief treasury and trading desks on the laundering pattern TRM expects next (bridges, swap services, OTC brokers) so that any inbound funds traceable to the theft are refused at intake.

## 5\. Indicators of compromise

No atomic indicators of compromise are available in the source material. The sources give no hashes, domains, IP addresses, file paths or wallet addresses tied to the intrusion. TRM states it has tied addresses to the theft and advises exchanges to screen against them, but those addresses are not reproduced in any source provided here; obtain them from TRM.

Behavioural indicators:

| behaviour                                                                                                | where to observe                                                                 | confidence                                          |
| -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | --------------------------------------------------- |
| DevOps workstation reaching a container that submits withdrawal transactions                             | EDR and container runtime logs on developer endpoints and the withdrawal service | Medium; Binance's initial finding, not yet detailed |
| Batch of 50 pre-signed EIP-7702 authorisations submitted so one matches the wallet transaction count     | Ethereum transaction pool and wallet signing logs                                | Medium; single-sourced to TRM                       |
| Valid signatures from wallets on ten chains with different key types and schemes within about 30 minutes | Hot wallet signing service audit logs                                            | Medium; single-sourced to TRM                       |
| Operator wallet funded by small Tornado Cash withdrawals before the theft                                | On-chain transaction history of attacker wallets                                 | Medium; single-sourced to TRM                       |
| Test transactions against other wallets before the live run                                              | On-chain history and signing service logs                                        | Low; TRM inference from preparation timeline        |

## 6\. Detection

Insufficient indicators to author detection rules. The sources contain no file artefacts, command lines, registry keys, process names or network strings belonging to the intrusion. The behavioural indicators in §5 are the usable detection surface, and they require on-chain and signing-service telemetry rather than host or network signatures.

## 7\. Sources

- Help Net Security, "Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record", https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/, 2026-10-30
- SecurityWeek, "$6 Billion Binance Hack Bears Hallmarks of North Korea's TraderTraitor", https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/, 2026-10-30
- The Hacker News, "Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen", https://thehackernews.com/2026/10/binance-suffers-security-breach.html, 2026-10-30
- The Register, "In the year AI re-wrote the infosec rulebook, it's comforting to know crypto exchanges still have bad security", https://www.theregister.com/security/2026/10/30/in-the-year-ai-re-wrote-the-infosec-rulebook-its-comforting-to-know-crypto-exchanges-still-have-bad-security/5306539, 2026-10-30

## 8\. Adverse Trace position

We assess this as a high-impact event for clients with direct crypto exposure and a moderate one for the wider EMEA financial services sector, which mostly meets it through counterparty and settlement risk rather than its own systems. The attribution to TraderTraitor is the leading assessment from TRM Labs and Chainalysis but is unconfirmed by any government source and has no MITRE ATT&CK profile, so we do not treat it as established. The technical detail that matters most to clients is the signing-infrastructure pattern: pre-signed authorisations and a submission path reachable from a developer laptop. We will obtain TRM's address list and circulate it to clients who need it for deposit screening, and we will revise this advisory when Binance publishes its post-mortem and updated Proof of Reserves.

---

[Read the original source →](https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*