Binance $6.3B Theft Attributed to North Korean TraderTraitor

Between October 29–30, 2026, attackers drained approximately $6.3 billion from Binance hot wallets across multiple blockchains. TRM Labs attributed the intrusion with high confidence to TraderTraitor, a North Korean state-sponsored actor. Initial access was gained via a compromised engineer/DevOps laptop, enabling unauthorized withdrawals from Binance hot wallet 0x28C6c06298d514Db089934071355E5743bf21d60. Attackers exploited Ethereum EIP-7702 via a Type-4 transaction containing 50 consecutive authorization payloads (nonces 18914775–18914824) to delegate execution to a malicious contract, draining 167,464 ETH and $1.615B USDT. Stablecoin issuers froze roughly $3 billion; over $3 billion remains at large.

• Incident Overview: Binance Hot Wallet Drain

  • $6.36B stolen (TRM Labs); largest crypto theft on record, over 4x the $1.5B Bybit hack.
  • Occurred October 29–30, 2026; Binance suspended deposits and withdrawals.
  • Exchange leadership pledged to cover all losses via SAFU fund and corporate reserves.

• Attack Vector & Technical Mechanics

  • Initial entry via compromised engineer/DevOps laptop; pivot to internal withdrawal infrastructure.
  • Exploited Ethereum EIP-7702 Type-4 transaction with 50 authorization payloads (nonces 18914775–18914824).
  • Nonce spray matched live Binance withdrawal backend; delegated execution to unverified malicious smart contract.
  • Self-destruct mechanism destroyed attacker tooling and on-chain tracers post-exploitation.

• Threat Actor Profile: TraderTraitor / Lazarus

  • North Korean state-sponsored group linked to the $1.5B Bybit theft (February 2025).
  • U.S. intelligence assesses Pyongyang nets ≥$1B annually in crypto heists for weapons programs.
  • TRM Labs and Elliptic attribute with high confidence; FBI engaged but has not publicly attributed.

• Indicators of Compromise & Asset Freezes

  • Binance 14 Hot Wallet: 0x28C6c06298d514Db089934071355E5743bf21d60.
  • Attacker receiving address: 0x5227...2f8c.
  • Drained assets: 167,464 ETH, $1.615B USDT, plus USDC, WBTC, and altcoins.
  • Stablecoin issuers froze ~$3B: Tether ($971M–$1.57B USDT), Circle (~$823M USDC), Ripple ($200M).

• Defensive Response & Industry Impact

  • Elliptic estimates 44% of stolen assets frozen; >$3B remains at large in non-freezable tokens.
  • Parallel supply-chain breach at Polymarket via DebugBear injected wallet-draining JavaScript (~$2M–$2.7M loss).
  • Binance launched companywide security review; FBI coordinating with government and industry partners.

• Conclusion

  • Largest recorded crypto heist exposes critical gaps in hot wallet security and DevOps endpoint protection.
  • EIP-7702 abuse demonstrates emerging risks in smart contract account delegation.
  • State-sponsored actors continue targeting exchanges to fund sanctioned weapons programs.