1. Executive summary
On 29 October 2026 roughly $6.3 billion in cryptocurrency left Binance wallets across ten blockchains in about 20 minutes, the largest crypto theft on record and roughly four times the February 2025 Bybit loss. Binance's initial investigation points to a compromised DevOps engineer's laptop as the entry point, followed by access to a service container used to submit unauthorised withdrawal transactions, with no evidence of a wallet private key leak. TRM Labs and Chainalysis both attribute the intrusion to TraderTraitor, the North Korean unit the FBI named in the Bybit theft, with TRM stating high confidence; TraderTraitor has no MITRE ATT&CK profile, so the attribution is unconfirmed at the actor-catalogue level even though it is multi-sourced across two blockchain intelligence firms. No CVE is associated with this item and there is no CISA KEV entry, so the exposure is not a patchable software flaw: it is a signing-infrastructure and endpoint compromise that any EMEA institution operating hot wallets, custody platforms or payment-signing services should treat as a direct control question. The bottom-line risk to EMEA financial services is concentrated in firms that hold digital assets or run privileged transaction-signing systems reachable from developer endpoints.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 19 | A major operational incident at a crypto exchange that EMEA clients use for custody, settlement or liquidity, with withdrawals suspended and losses covered from reserve funds | Clients with Binance exposure must assess whether the disruption meets their own major-incident threshold and, if so, report to their competent authority within the DORA timelines |
| DORA Art. 28 | The loss originated in a third-party exchange's internal signing infrastructure, not the client's own systems | Clients relying on Binance or similar venues must document the dependency and confirm contractual incident-notification and service-continuity terms with that provider |
| NIS2 Art. 21(2)(d) | The compromise path ran through a third-party-operated exchange whose failure disrupted client settlement | In-scope entities must be able to evidence supply chain security measures covering crypto and custody providers in their dependency chain |
3. Technical analysis & attack chain
The confirmed sequence, from Binance's own statements and TRM Labs' on-chain tracing:
- An attacker gained a foothold on a Binance DevOps engineer's laptop. Binance describes this as a possible entry point and says investigators identified additional breach points, so the laptop is not established as the sole initial access vector.
- From that foothold the attacker reached a service container and used it to submit unauthorised withdrawal transactions.
- On Ethereum, the attacker used EIP-7702, which lets a standard wallet delegate its behaviour to a smart contract by signing a permission. They prepared a batch of 50 such permissions, all signed in advance by a Binance hot wallet, so that one would match the wallet's transaction count at execution time. The wallet ended up delegated to a contract only the attackers could command.
- Across the other chains, Binance wallets sent funds to the attackers through regular, validly signed transactions. TRM notes the wallets used different chains, key types and signing schemes, and all produced valid signatures for the attacker within about half an hour. TRM's assessment is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
- About $6.36 billion left wallets on ten blockchains (The Record reports 20 blockchains including Bitcoin, Ethereum, Tron, the XRP Ledger and Solana; the discrepancy between ten and 20 is unresolved in the sources). Most of the money moved within roughly 20 minutes.
- TRM traced groundwork beginning at least 36 hours before the theft, including test runs moving money between attacker-controlled wallets and a small Tornado Cash withdrawal used to fund the operator wallet.
The EIP-7702 detail matters to defenders because it explains how a hot wallet can be made to sign away its contents without a private key leak: the key stays intact, but the wallet's behaviour is delegated to attacker-controlled code. TRM initially read the Ethereum activity as phishing, then rejected that as the sole explanation because phishing does not account for the other chains producing valid signatures under different schemes. The common factor across chains is the signing system, not the individual wallet.
Laundering differed from the Bybit case. Instead of cross-chain bridges, the attackers mainly used large trades with market makers and lending platforms. Chainalysis found proceeds from last month's Bitget exploit mixed with funds taken from Binance.
Freezes: by 00:30 UTC on 30 October TRM tallied about $2.7 billion frozen, including roughly 1.77 billion USDT by Tether and about 825 million USDC by Circle, with smaller amounts by Ripple and World Liberty Financial and about $30 million moved out of an attacker wallet by Arbitrum's Security Council. Binance and other reporting put the frozen total near $3 billion. These figures are developing estimates, not a final accounting. The hackers still held more than 420,000 ETH and 18,270 BTC at the time of reporting.
Confidence caveats. The TraderTraitor attribution rests on TRM Labs and Chainalysis, both stating high confidence, plus an independent naming by ZachXBT; Binance has not publicly identified the attackers. TraderTraitor has no MITRE ATT&CK profile, so the actor-level attribution is unconfirmed in catalogue terms even though it is corroborated across two firms. The specific mechanism of the laptop compromise (phishing, malware, credential theft) is not described in any source and should not be assumed. Binance has promised a technical post-mortem; until it is published, the initial-access detail is single-sourced to Binance's own statements.
4. Mitigation & containment
P1 within 24h
- If your institution holds assets on Binance or routes settlement through it, confirm current withdrawal and deposit status directly on Binance's official channels and reconcile balances against your own records. Do not act on messages claiming to offer recovery or compensation.
- Inventory every system that can sign or authorise a transaction on a hot wallet, and confirm which developer endpoints, CI runners and service containers can reach it. The Binance path ran from an engineer laptop to a service container to the signing system; map the equivalent path in your estate.
- For any Ethereum wallet under your control, review for EIP-7702 delegations you did not authorise. A delegated wallet can be drained without a key compromise. Revoke unexpected delegations.
- Treat requests for authentication codes or "urgent verification" tied to this incident as fraud. Binance has asked customers to use official channels only.
P2 within 72h
- Enforce separation between developer workstations and transaction-signing infrastructure: no direct interactive access from laptops to signing services, and signing actions require a second approval path that does not share credentials with the developer endpoint.
- Require pre-signed transaction batches to be bound to a specific transaction count and expiry, and alert on any batch of pre-signed permissions that exceeds normal volume. The 50-permission batch is the pattern to detect.
- Restrict outbound access from developer endpoints to signing and custody APIs, and log every signing request with the originating host, user and container.
P3 within 7 days
- Add crypto and custody providers to third-party risk review under DORA Art. 28, confirming contractual incident-notification, service-continuity and reserve-backing terms.
- Rehearse the incident-reporting path for a third-party exchange failure so a withdrawal freeze at a venue can be classified and reported within DORA Art. 19 timelines if it meets your threshold.
- Monitor Binance's promised technical post-mortem and update this advisory's initial-access section when it publishes.
5. Indicators of compromise
No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. The sources describe behaviours and on-chain patterns only.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Batch of 50 pre-signed EIP-7702 permissions from a single hot wallet | Ethereum signing logs, wallet transaction-count monitoring | High (TRM Labs) |
| Hot wallet delegated to a contract not previously authorised | On-chain delegation state, wallet config | High (TRM Labs) |
| Valid signatures produced across multiple chains and key types within about 30 minutes | Signing service audit logs, cross-chain correlation | High (TRM Labs) |
| Operator wallet funded by small Tornado Cash withdrawals | On-chain funding-graph analysis | Medium (TRM Labs) |
| Test transfers between attacker-controlled wallets 36+ hours before theft | On-chain monitoring of staging wallets | Medium (TRM Labs) |
| Access from a developer laptop to a service container that submits withdrawals | EDR, container runtime logs, CI/CD audit | Medium (Binance initial finding, not independently confirmed) |
6. Detection
Insufficient indicators to author detection rules. The sources provide no file artefacts, command lines, mutexes, registry keys or distinctive strings belonging to the threat itself; the observable signals are on-chain and signing-log behaviours listed in §5, which are better expressed as monitoring queries against your own signing infrastructure than as YARA or Sigma rules built from absent artefacts.
Threat actor context
Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …
No MITRE ATT&CK profile for: TraderTraitor.
7. Sources
- Cybersecurity Dive, "North Korea-linked group steals $6.3B from Binance in largest-ever cryptocurrency hack", https://www.cybersecuritydive.com/news/binance-hack-north-korea-cryptocurrency-theft/873304/, 2026-10-30
- SecurityWeek, "$6 Billion Binance Hack Bears Hallmarks of North Korea's TraderTraitor", https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/, 2026-10-30
- Help Net Security, "Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record", https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/, 2026-10-30
- Malwarebytes Labs, "Binance hit by largest-ever crypto theft, with $6.3 billion stolen", https://www.malwarebytes.com/blog/news/2026/10/binance-hit-by-largest-ever-crypto-theft-with-6-3-billion-stolen, 2026-10-30
- The Record (Recorded Future), "Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds", https://therecord.media/binance-hit-by-record-6-billion-crypto-hack, 2026-10-30
8. Adverse Trace position
Adverse Trace assesses this as a high-impact third-party incident with a credible but catalogue-unconfirmed state-actor attribution: TraderTraitor has no MITRE ATT&CK profile, so while TRM Labs and Chainalysis both attribute with high confidence, we treat the actor identity as unconfirmed and the initial-access mechanism as single-sourced to Binance pending its post-mortem. No CVE or CISA KEV entry applies; the exposure is signing-infrastructure and endpoint compromise, not a patchable flaw. Client impact is concentrated in EMEA institutions with direct Binance exposure or hot-wallet signing systems reachable from developer endpoints, and in any firm whose settlement depends on Binance liquidity. We will monitor Binance's technical post-mortem, track the on-chain freeze and recovery totals as they firm up, and reissue this advisory if the post-mortem confirms or contradicts the laptop-to-container path.
Published via PulseTrace — Adverse Trace threat intelligence.