Binance loses about $6.3 billion in heist linked to TraderTraitor
Original title: $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
TRM tracked $6.36 billion across ten chains in about 20 minutes; roughly $3 billion is frozen and $2.4 billion remains movable.
Binance says roughly $6.3 billion was taken on October 29 in what TRM Labs calls the largest recorded crypto heist. TRM followed about $6.36 billion out of Binance wallets on ten blockchains, most of it within about 20 minutes. Binance’s early findings point to a compromised DevOps engineer’s laptop used to submit unauthorized withdrawals, and it reports no private-key leak. TRM attributes the theft to North Korea’s TraderTraitor with high confidence; Binance has not named the attackers. Issuers froze roughly $3 billion, while about $2.4 billion in ETH and BTC cannot be frozen.
Unconfirmed: TraderTraitor attribution is from TRM, Chainalysis and ZachXBT; Binance has not identified the attackers.
- The haul exceeds the $1.5 billion taken from Bybit in February 2025.
- TRM says preparation lasted at least a day and a half, including Tornado Cash funding.
- On Ethereum, pre-signed EIP-7702 permissions delegated a hot wallet to an attacker contract.
- Tether locked about 1.77 billion USDT and Circle about 825 million USDC.
- Attackers still hold over 420,000 ETH and 18,270 BTC, TRM says.
Impact: About $6.3 billion taken from Binance wallets
- Threat actors
- TraderTraitorLazarus Group
- Victims
- Binance
- Organizations
- TRM LabsChainalysisTetherCircle
- Countries
- North Korea
From the original article
3 min read at securityweek.com
Blockchain analysts link the record crypto theft to North Korean hackers, as Binance probes a possibly compromised engineer laptop. The post $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.