Skip to content
NewA calmer, faster ZeroHour
StoryData breachcriticalExploited in the wild

FBI ties $6.3 billion Binance hot-wallet theft to TraderTraitor

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Binance says a months-long intrusion stole about $6.3 billion; the FBI blames TraderTraitor, while North Korea denies it.

Binance says attackers stole roughly $6.3 billion to $6.34 billion from hot wallets on October 29, 2026, after a campaign that began in June. The FBI attributes the theft to North Korea’s TraderTraitor group; North Korea denies responsibility, while Security Affairs instead names Lazarus, or APT38. Binance says fake job interviews, a tampered Homebrew or AI coding-tool install, and abuse of an internal AI tool and wallet-signing service, including Ethereum EIP-7702 delegation, enabled the transfers. Frozen amounts differ: outlets cite about $2.8 billion, $2.85 billion, or $3 billion, and replenishment is reported as 95 percent or 98 percent. Binance says it will cover the loss from reserves and is tracing funds with partners and law enforcement.

Key facts
  • Theft occurred October 29, 2026; FBI says more than $6 billion, Binance about $6.34 billion.
  • Campaign began in June; a September fake job or coding lure compromised engineers.
  • Five hot wallets sent 233.46 million XRP in minutes, plus later SOL, OP and BTC.
  • Binance cleared an EIP-7702 delegation at 00:10 UTC on October 30.
  • SecurityWeek says $3.18 billion remains in theft-linked addresses.
  • Elliptic says funds moved through about 12,000 wallets on 11 blockchains.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jun 1, 2026Campaign begins with a tampered Homebrew or AI coding-tool install. · The Record
  2. Sep 1, 2026Fake job assignment or coding exercise compromises another engineer. · The Record
  3. Oct 20, 2026Lateral movement inside Binance begins, The Record says. · The Record
  4. Oct 29, 2026Hot-wallet transfers drain billions within minutes. · Cyber Security News
  5. Oct 30, 2026Binance clears the attacker’s Ethereum delegation. · Cyber Security News
  6. Oct 31, 2026Binance says 98 percent of impacted tokens were replaced. · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsGives transfer amounts, times, and the October 30 delegation clearing.
  • The RecordDates lateral movement to October 20 and reports North Korea’s denial.
  • Security AffairsAttributes the operation to Lazarus, also known as APT38.
  • SecurityWeekSays $3.18 billion remains in theft-linked addresses.
  • Risky Business NewsSays $2.8 billion in stablecoins was recovered and $3.25 billion is unrecoverable.
Vendors
Binance
Products
binance wallethot walletwithdrawal servicecryptocurrencieshot wallets
Threat actors
TraderTraitorLazarus GroupNorth Korean hackers
Malware
MacSync Stealerzero-day malware
Victims
Binance
Organizations
NCC GroupFBIEllipticCoinDesk
Countries
North KoreaUnited States

Coverage

oldest first · one row per article · UTC
  1. · 9d ago Help Net SecurityFirst report

    FBI confirms North Korea responsible for $6.3 billion Binance hack

    FBI links theft to TraderTraitor; users urged to block 628 crypto addresses.

  2. · 9d ago Infosecurity Magazine

    FBI attributes $6bn Binance heist to North Korea's TraderTraitor

    North Korea-linked group TraderTraitor stole over $6 billion from Binance cryptocurrency exchange.