✅ Report Title: Binance Hot Wallet Compromise and Multi-Chain Asset Theft

✅ Executive Summary

• A security breach that began at Binance's hot wallet on October 29, 2026 resulted in the theft of approximately USD 6.3–6.4 billion in assets across 10 or more blockchains.
• The FBI and major blockchain analytics firms assessed the attack as the work of the North Korea-backed APT group TraderTraitor.
• The threat actor exploited Ethereum's EIP-7702 delegated authorization feature to repeatedly steal hot wallet assets, and Binance responded by halting withdrawals, freezing assets, and committing to fully compensate user losses.

📌 Binance Hot Wallet Incident Overview

• Asset Outflow Start: According to TRM Labs, unauthorized asset transfers began from a Binance wallet on the XRP Ledger around 20:05 UTC on October 29, 2026. This is the time the outflow was first observed on-chain; the time of the initial internal breach has not been disclosed.
• Extent of Damage: Binance announced losses of approximately USD 6.3 billion, while TRM Labs estimated approximately USD 6.36 billion based on prices at the time, and Elliptic estimated approximately USD 6.43 billion.
• Impact Scope: TRM Labs tracked asset outflows across 10 blockchains, including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon, while Elliptic counted losses across 11 chains, including NEAR, in its November 1 update.
• Attribution: The FBI announced on October 31 that North Korea was responsible for this asset compromise and identified the group behind it as TraderTraitor. Chainalysis and TRM Labs also assessed that TraderTraitor was highly likely responsible, while Elliptic had identified TraderTraitor as the leading suspect even before the FBI announcement.
  • Who is the threat actor TraderTraitor? A North Korea-backed APT group operating with the primary goal of stealing cryptocurrency, identified through a U.S. government security advisory issued in April 2022. It primarily targets cryptocurrency exchanges, DeFi platforms, and related companies to steal digital assets, and is tracked by security firms under names such as UNC4899, Jade Sleet, and Slow Pisces.
    • Related Report: Analysis of TraderTraitor’s GopherGrabber Malware observed by Willo Campaign
    • Related Report: Analysis of DPRK-Linked Money Laundering Infrastructure

📌 Binance Hot Wallet Incident Details

• 1. Binance's Initial Investigation Results and Additional Explanation
  • Binance stated that the compromise of a DevOps engineer's laptop may have allowed the threat actor to access service containers and submit unauthorized withdrawal transactions, but said no evidence of private key leakage had been found at the time.
  • Binance subsequently identified additional compromised points and explained that the attack was carried out not through a single engineer's authority alone, but through a complex process. However, the initial means of infiltration and the lateral movement path within the network were not disclosed.
• 2. Pre-positioning and Asset Outflows Observed On-Chain
  • TRM Labs confirmed that the threat actor had received operational funds via Tornado Cash starting October 28, and had deployed and tested attack code, signs of pre-attack preparation. However, this record alone cannot determine the timing or method of the initial internal breach.
  • Outflows from the XRP Ledger began around 20:05 UTC on October 29, with the bulk of outflows concentrated over approximately 20 minutes. Additional outflows were later observed on Avalanche and Polygon around 23:05.
• 3. Exploitation of Ethereum's EIP-7702 Delegated Authorization
  • Around 20:20 on October 29, the threat actor submitted 50 pre-signed delegation approvals, each specifying a different consecutive nonce, within a single transaction; the approval matching the nonce at the time of execution was applied.
  • The threat actor's sweeper contract code was executed on the delegated hot wallet, transferring out assets; while the delegation remained active, newly incoming assets were also repeatedly transferred without additional signatures.
  • The compromised hot wallet's execution authority over other Binance smart accounts was also exploited, resulting in an additional withdrawal of 823 million USDC. According to ThreatMon, the malicious delegation remained in effect for approximately 3 hours and 50 minutes until it was revoked at 00:10:35 on October 30.
• 4. Assessment of Validly Signed Transactions from Other Wallets and Causes of Compromise
  • TRM Labs identified standard asset-transfer transactions with valid signatures from Binance wallets on other chains and from a separate Ethereum hot wallet.
  • Based on transactions being executed within a short period across different chains and signing methods, TRM Labs suggested the threat actor may have been able to request signatures for arbitrary transactions from the hot wallet signing system. However, this is only an assessment by analysis firms, and whether the private key itself was leaked has not been confirmed.
• 5. Suspicious signs of the conversion and automation of compromised assets
  • The threat actor exchanged freezable stablecoins for ETH and other assets, then moved the funds using lending and cross-chain services.
  • Chainalysis suggested the possibility of automated fund movement, citing thousands of transactions within a short period, repeated 1 TRX payments, and circular transfer patterns.
  • Chainalysis also assessed this attack as the work of TraderTraitor, based on evidence that the stolen funds were mixed on-chain with funds from the September Bitget incident, which was attributed to North Korea.
• 6. Binance and External Organizations’ Response
  • Binance stated that it temporarily suspended withdrawals, revoked the permissions of affected addresses, and worked with blockchain partners to freeze the related assets.
  • In its October 30 announcement, Binance stated that approximately USD 3 billion had been frozen on-chain, and announced it would fully compensate user losses through the SAFU fund and company funds.

✅ Threat Detection Recommendations and Mitigation Measures:

• Detection
  • (Illegitimate Withdrawals) Based on normal transaction volumes by chain and asset, detect large-scale withdrawals within a short period, new receiving addresses, abnormal fees, and transaction patterns, and perform correlation analysis on anomalous withdrawals occurring simultaneously across multiple chains.
  • (Signature Requests) Verify not only the caller of requests entering the signing service, but also the chain, transaction target, amount, nonce, calldata, and whether authority has been delegated, through policy. A large volume of EIP-7702 delegation approval requests for consecutive nonces from the same account should be treated as a high-risk indicator.
  • (Delegated Authority Status) Monitor the hot wallet's on-chain code and delegation targets, and issue an immediate alert if any unauthorized change occurs.
  • (Developer and DevOps Endpoints) Collect authentication history and operational environment access records for endpoints, and check for session reuse from new locations, use of service credentials, and abnormal container changes.
• Initial Response
  • (Transaction Restriction) Halt withdrawals and signing requests from wallets suspected of compromise, and assess the scope of impact.
  • (Delegation Revocation) Separately from suspending withdrawals, check the EIP-7702 delegation status. If a malicious delegation exists, revoke it according to the pre-validated procedure and verify whether the revocation is reflected on-chain.
  • (Access Restriction and Evidence Preservation) Restrict access for suspected devices and service accounts, and preserve authentication records, signing requests, container logs, and original transaction data.
• Asset Tracking and Collaboration
  • Incorporate addresses disclosed by the FBI and analysis firms into transaction monitoring, and trace the flow of funds.
  • For assets subject to freezing authority held by issuers or operators, coordinate emergency response with the relevant institutions, managing freezing/securing and actual return as separate matters.
• Recovery and Prevention of Recurrence
  • Separate the authority to submit signature requests from the authority to approve signatures, and apply transaction limits per wallet and recipient address verification.
  • Inspect the execution permissions the compromised wallet holds over other smart accounts, and verify the approval paths and emergency delegation revocation procedures for each chain and wallet.