Skip to content
NewA calmer, faster ZeroHour
StoryData breachcritical

Binance Loses $6.3B to North Korean Hackers October 29

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

North Korea's TraderTraitor stole $6.3B from Binance on October 29 using a compromised laptop and AI tools, with the exchange covering losses and resuming withdrawals.

Binance reported a $6.3B cryptocurrency theft on October 29, 2026, with initial investigation pointing to a compromised DevOps engineer's laptop granting access to a service container for unauthorized withdrawals. The exchange found no evidence of a wallet private-key leak and pledged to cover losses from the SAFU fund and company reserves. TRM Labs, Chainalysis, and the FBI attributed the attack to North Korea's TraderTraitor group, which used EIP-7702 delegations and sweeper contracts on Ethereum plus signed transfers on other chains. Issuers froze about $2.7B, Binance resumed withdrawals after pausing them, and the group retains significant holdings including over 420,000 ETH.

Key facts
  • October 29, 2026: $6.3B stolen from Binance hot wallets across 10 blockchains
  • TraderTraitor (Lazarus Group, APT38) attributed by TRM, Chainalysis, FBI
  • Compromised DevOps laptop and multi-stage campaign beginning June 2026
  • Issuers froze ~$2.7B; Binance replenished 95-98% from company funds
  • Withdrawals paused, expected to resume within 48 hours
  • Attacker still holds 420,000+ ETH and 18,270 BTC
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026Lateral movement began toward wallet infrastructure · The Record
  2. Oct 29, 2026$6.3B drained from Binance wallets in under 20 minutes · TRM Labs
  3. Oct 30, 2026Binance covers losses and resumes withdrawals · Help Net Security
  4. Nov 2, 2026FBI flags 608 laundering addresses tied to TraderTraitor · SecurityWeek

What each outlet adds

beyond the shared facts
  • The RecordDetails months-long campaign with fake jobs and AI tools
  • Dark ReadingEthereum delegation and bypassed approval controls explained
  • SecurityWeekFBI address list for laundering and ongoing automation
  • Security AffairsFBI official attribution to North Korea
  • BleepingComputerComparison to Bybit $1.5B theft
Vendors
Binance
Products
binance wallethot walletwithdrawal service
Threat actors
Lazarus GroupTraderTraitorAPT38
Victims
Binance
Organizations
NCC GroupFBITetherCircleTRM LabsChainalysisTRMRippleWorld Liberty FinancialEllipticUSSSIRS-CI
Countries
North KoreaUnited States

Coverage

oldest first · one row per article · UTC
  1. · 12d ago SecurityWeekFirst report

    Binance loses about $6.3 billion in heist linked to TraderTraitor

    TRM tracked $6.36 billion across ten chains in about 20 minutes; roughly $3 billion is frozen and $2.4 billion remains movable.

  2. · 12d ago Help Net Security

    Binance reports about $6.3 billion stolen in crypto heist

    Binance will cover user losses, and close to $3 billion has already been frozen on-chain.