UPDATE: Binance $6.4B hack traced to North Korea after signing breach
CIE News ·
Update to UPDATE: Binance exploiters retain $3.33B as frozen funds hit $2.8B
Based on reporting by Decrypt; not yet independently confirmed.
Analytics firms attributed the $6.4B Binance exploit to North Korea's TraderTraitor, following an infrastructure breach across 10 blockchains on October 29.
North Korea-linked group TraderTraitor was behind the $6.4 billion exploit of Binance on October 29, 2026, according to Chainalysis and TRM Labs. The attribution follows earlier reports that perpetrators still controlled $3.33 billion in assets while stablecoin issuers froze funds. Attackers began draining hot wallets across roughly 10 blockchains at 4:05 p.m. ET, taking most of the funds within about 20 minutes.
The intrusion stemmed from compromised signing infrastructure rather than a flaw in underlying blockchains, according to TRM Labs. On Ethereum, perpetrators used EIP-7702 and 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper contract. Binance CEO Richard Teng said the delegation bypassed standard approval controls and involved a more complex attack process that did not simply use one engineer's permissions.
Teng stated that user assets were not touched and confirmed Binance set aside over $6.34 billion across reserve and company funds to fully cover losses. Binance aims to restore paused withdrawals by Sunday, while deposits continue to function normally.
Key facts
- $6.4B stolen on Oct 29
- TraderTraitor blamed
- 10 blockchains affected
- Signing infra breached