FlagThis
← Back to Daily Briefing (#APT38)

Binance $6.3B Theft Attributed to North Korean TraderTraitor

Published November 5, 2026
Breach/Leak🏢 Binance#TraderTraitor#Binance#EIP-7702#CryptoTheft#NorthKorea

Between October 29–30, 2026, attackers drained approximately $6.3 billion from Binance hot wallets across multiple blockchains. TRM Labs attributed the intrusion with high confidence to TraderTraitor, a North Korean state-sponsored actor. Initial access was gained via a compromised engineer/DevOps laptop, enabling unauthorized withdrawals from Binance hot wallet 0x28C6c06298d514Db089934071355E5743bf21d60. Attackers exploited Ethereum EIP-7702 via a Type-4 transaction containing 50 consecutive authorization payloads (nonces 18914775–18914824) to delegate execution to a malicious contract, draining 167,464 ETH and $1.615B USDT. Stablecoin issuers froze roughly $3 billion; over $3 billion remains at large.

  • Incident Overview: Binance Hot Wallet Drain

    • $6.36B stolen (TRM Labs); largest crypto theft on record, over 4x the $1.5B Bybit hack.
    • Occurred October 29–30, 2026; Binance suspended deposits and withdrawals.
    • Exchange leadership pledged to cover all losses via SAFU fund and corporate reserves.

  • Attack Vector & Technical Mechanics

    • Initial entry via compromised engineer/DevOps laptop; pivot to internal withdrawal infrastructure.
    • Exploited Ethereum EIP-7702 Type-4 transaction with 50 authorization payloads (nonces 18914775–18914824).
    • Nonce spray matched live Binance withdrawal backend; delegated execution to unverified malicious smart contract.
    • Self-destruct mechanism destroyed attacker tooling and on-chain tracers post-exploitation.

  • Threat Actor Profile: TraderTraitor / Lazarus

    • North Korean state-sponsored group linked to the $1.5B Bybit theft (February 2025).
    • U.S. intelligence assesses Pyongyang nets ≥$1B annually in crypto heists for weapons programs.
    • TRM Labs and Elliptic attribute with high confidence; FBI engaged but has not publicly attributed.

  • Indicators of Compromise & Asset Freezes

    • Binance 14 Hot Wallet: 0x28C6c06298d514Db089934071355E5743bf21d60.
    • Attacker receiving address: 0x5227...2f8c.
    • Drained assets: 167,464 ETH, $1.615B USDT, plus USDC, WBTC, and altcoins.
    • Stablecoin issuers froze ~$3B: Tether ($971M–$1.57B USDT), Circle (~$823M USDC), Ripple ($200M).

  • Defensive Response & Industry Impact

    • Elliptic estimates 44% of stolen assets frozen; >$3B remains at large in non-freezable tokens.
    • Parallel supply-chain breach at Polymarket via DebugBear injected wallet-draining JavaScript (~$2M–$2.7M loss).
    • Binance launched companywide security review; FBI coordinating with government and industry partners.

  • Conclusion

    • Largest recorded crypto heist exposes critical gaps in hot wallet security and DevOps endpoint protection.
    • EIP-7702 abuse demonstrates emerging risks in smart contract account delegation.
    • State-sponsored actors continue targeting exchanges to fund sanctioned weapons programs.

Related posts

  1. news.ycombinator.com — 'Elite North Korean hackers' blamed for $6.3B Binance hack
  2. Bitcoin News - Security — Gate CEO Calls for Crypto Security Alliance After $6.3B Binance Hack
  3. gbhackers.com — North Korean Hackers Steal $6.36 Billion From Binance in Largest Crypto Hack Ever
  4. Malware News — North Korea’s Crypto Heists Start on the Open Internet
  5. News4Hackers — TRM Labs Exposes North Korean Hackers Behind $6.3 Billion Binance Crypto Raid
  6. thehackernews.com — FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist
  7. www.helpnetsecurity.com — Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability
  8. phoenix.security — Binance $6.3B Hack: How a Compromised DevOps Laptop Reached the Hot-Wallet Signer (No CVE)
  9. esecurityplanet.com — North Korea Rejects FBI Attribution of $6.3 Billion Binance Hack
  10. News4Hackers — Binance Security Breach: Social Engineering Scam Led to $6.34 Billion Hack
  11. ReversingLabs Malware Feed — Binance heist: what we know, and what RL sees in TraderTraitor's toolkit
  12. itpro.com — How the Binance hack happened
  13. datawater.com — Binance’s $6.34 Billion Hack Began With a Fake Job Interview. Your Developers Are Next.
  14. cybrsecmedia.com — Binance, the $6.34 Billion Theft, and the Fake Recruiter Attack: Lessons Learned
  15. Bitcoin News - Security — North Korea’s $6.3B Binance Hack Takes a Strange Turn With Meme Coins
  16. blog.knowbe4.com — CyberheistNews Vol 16 #45 FBI: North Korea Was Behind $6 Billion Cryptocurrency Theft
  17. The Record by Recorded Future — Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools
  18. Security Affairs — North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure
  19. bleepingcomputer.com — Binance probes potential $5.8 billion crypto-theft hack
  20. Cybersecurity News — World’s Largest Crypto Exchange Binance Hacked, Over $5.7 Billion Reportedly Stolen
  21. thehackernews.com — Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen
  22. cyberinsider.com — Binance links $6.3 billion security incident to compromised laptop
  23. Bitcoin News - Security — Binance Hack Pinned on North Korea’s Lazarus Group by TRM Labs and ZachXBT
  24. iTnews — Binance freezes assets after US$6.3 billion heist
  25. www.helpnetsecurity.com — Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record
  26. Malware News — Binance Hack: Inside the $6.3B Hot Wallet Theft
  27. Cybersecurity News — Binance Hit by Biggest Crypto Heist in History – North Korean TraderTraitor Group Reportedly Stolen $6.36 Billion
  28. bleepingcomputer.com — Binance links $6.3 billion crypto theft to compromised DevOps laptop
  29. computerweekly.com — North Korean ‘elite’ hacking group steals $6.36bn from Binance
  30. cybersafe.news — Binance Loses $6.3 Billion in Epic Crypto Theft
  31. Wired Security — The $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes
  32. cybersecuritydive.com — North Korea-linked group steals $6.3B from Binance in largest-ever cryptocurrency hack
  33. slashdot.org — Binance Suffers Biggest Crypto Hack In History With $6.3 Billion Affected [UPDATE]
  34. Malware News — FBI is involved in response to $6.3 billion Binance hack linked to North Korea
  35. esecurityplanet.com — Binance Reports $6.3 Billion Crypto Hack as Partners Race to Freeze Funds
  36. Bitcoin News - Security — New Breach Points: Binance CEO Reveals Fresh Findings in $6.3B Hack
  37. Security Affairs
  38. DEV Community — Inside the $6.3 Billion Binance Heist: How an Engineer's Laptop, EIP-7702, and Missing Zero-Trust Shattered History's Largest Crypto Exchange
  39. techjacksolutions.com — TRM Labs and Chainalysis Attribute ~$5.9B Binance Hot Wallet Theft to TraderTraitor (DPRK) in Alleged Largest Crypto Heist on Record
  40. Bitcoin News - Security — XRP Hit First in Binance Hack: Five Wallets Drained in About Four Minutes
  41. simplysecuregroup.com — FBI Confirms North Korean Hackers Responsible for $6 Billion+ Binance Attack
  42. simplysecuregroup.com — FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist
  43. falconinternet.net — Binance links $6.3B theft to a compromised DevOps engineer laptop
  44. Security Affairs — FBI Blames North Korea for $6 Billion Binance Crypto Theft
  45. simplysecuregroup.com — FBI links $6.3 billion Binance crypto heist to North Korean hackers
  46. bleepingcomputer.com — FBI links $6.3 billion Binance crypto heist to North Korean hackers
  47. The Record by Recorded Future — FBI blames N. Korea’s TraderTraitor for Binance theft, urges crypto industry to block transactions
  48. Bitcoin News - Security — Binance Hacker Moves All $293M in Stolen XRP as $242M Slips out Through Tron
  49. www.helpnetsecurity.com — FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users
  50. esecurityplanet.com — Binance Crypto Hack: North Korean Hackers Reportedly Steal $6.36 Billion
  51. Bitcoin News - Security — Binance Says Fake Job Interview, Compromised AI Tools Led to $6.3 Billion Hack
  52. Cybersecurity News — North Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance Heist
  53. The Record by Recorded Future — Binance CEO says ‘months-long campaign’ led to $6.3 billion theft as N. Korea denies responsibility
  54. thehackernews.com — Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft
  55. Wired Security — Binance Says Hackers Used Well-Known Tricks to Carry Out a $6.34 Billion Heist
  56. Security Affairs — Binance Hack: How Fake Job Interviews and AI Abuse Led to a $6.34 Billion Attack
  57. bleepingcomputer.com — Binance says fake job interview led to $6.3 billion crypto heist
  58. www.helpnetsecurity.com — Fake job interview opened the door to $6.34 billion Binance heist
  59. DEV Community — The fake coding test behind the $6.3B Binance hack, and what developers should take from it
  60. Bitcoin News - Security — CZ Warns AI Is Outpacing Crypto Defenses After $6.3B Binance Hack
  61. SecurityWeek — FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
  62. Expert In the Cloud — When a DevOps Device Becomes the Path to Billions
  63. skeletos.io — Five Months of Patience, 20 Minutes of Theft: How to Stop the Next $6.3 Billion Crypto Heist
  64. blackswan-cybersecurity.com — THREAT ADVISORY BINANCE: Fake Job Interviews, Malicious Software & Trusted-Application Abuse – November 5, 2026
  65. Cybersecurity News — US Freezes $2.7 Billion Stolen by North Korean Hackers in Massive $6 Billion Binance Crypto Heist
  66. Scripting
  67. Cyberscoop
  68. Finance
  69. Timesofindia
  70. Cryptonews
  71. Justice
  72. Cryptobriefing
  73. SecurityWeek — FBI Says US Seized $1.2 Billion Worth of Cryptocurrency Stolen From Binance
LINK COPIED TO CLIPBOARD