FlagThis — Daily Cybersecurity Intelligence Briefing

Between October 29–30, 2026, attackers drained approximately $6.3 billion from Binance hot wallets across multiple blockchains. TRM Labs attributed the intrusion with high confidence to TraderTraitor, a North Korean state-sponsored actor. Initial access was gained via a compromised engineer/DevOps laptop, enabling unauthorized withdrawals from Binance hot wallet 0x28C6c06298d514Db089934071355E5743bf21d60. Attackers exploited Ethereum EIP-7702 via a Type-4 transaction containing 50 consecutive authorization payloads (nonces 18914775–18914824) to delegate execution to a malicious contract, draining 167,464 ETH and $1.615B USDT. Stablecoin issuers froze roughly $3 billion; over $3 billion remains at large.