On October 29, 2026, Binance suffered a devastating breach resulting in losses exceeding $6.3 billion. Security firm TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean threat group specializing in infiltrating financial platforms. In just twenty minutes, the attackers drained active wallets across ten blockchain networks, targeting substantial amounts of Ethereum, Bitcoin, Tron, XRP, and Solana. Binance immediately confirmed the incident, halted withdrawals on multiple networks to prevent further losses, and assured users their assets remained protected.
The investigation revealed a sophisticated attack vector centered on the EIP-7702 delegation mechanism on the Ethereum network, which allowed attackers to link Binance's hot wallet to a malicious contract with direct execution capabilities. The attackers sent fifty sequential signatures to synchronize with the account, siphoning hundreds of thousands of tokens and massive volumes of stablecoins. Simultaneous transactions across other networks pointed to a compromise of the exchange's core signing infrastructure. In rapid mitigation efforts, stablecoin issuers Tether and Circle, working with network councils, managed to freeze approximately $2.7 billion to limit fund laundering.
Binance Brazil indicated that a compromised DevOps engineer's notebook likely served as the initial entry point. Preliminary investigation suggested this access allowed attackers to reach a service container and execute unauthorized withdrawal transactions. While Binance found no evidence of private key compromise initially, subsequent updates revealed multiple breach points, indicating a far more complex operation than a single machine compromise. Key questions remain about how the laptop was infiltrated and which steps led to the withdrawals.