Binance drained of up to $6.43 billion in suspected Lazarus Group breach
CIE News ·
Preliminary statement from the organization involved; full details not yet released.
Hackers drained up to $6.43 billion from Binance on October 29 across multiple blockchains, with investigators attributing the attack to North Korea's TraderTraitor.
On October 29, 2026, hackers extracted between $6.3 billion and $6.43 billion from Binance across multiple blockchains, according to reports documented by wikipedia.org and thehackernews.com. TRM Labs and Elliptic attributed the incident to the North Korea-linked TraderTraitor, a group tied to the Lazarus Group, though North Korea denied involvement. The breach heavily affected Ethereum (ETH) and Bitcoin (BTC), alongside chains including TRON, XRP Ledger, and Solana.
According to thehackernews.com, Binance revealed that the exploit stemmed from a supply chain breach involving a trojanized Homebrew package, fake recruitment interviews, compromised engineers, and the misuse of internal artificial intelligence tools. Binance Chief Executive Officer Richard Teng stated that attackers used an EIP-7702 protocol mechanism on the exchange's hot wallet to execute unauthorized transfers.
Binance coordinated with partners including Tether and Circle to freeze approximately $3 billion worth of stolen stablecoins, according to wikipedia.org. The exchange halted trading during the event, pledged to cover all customer losses, and resumed user withdrawals on November 1, 2026, processing $4.65 billion in assets that day.
Key facts
- Up to $6.43B stolen
- Lazarus Group suspected
- Roughly $3B stablecoins frozen
- Withdrawals resumed Nov 1