Binance Hack (October 2026): How It Happened, Root Causes and How to Protect Yourself

Binance said on 30 October 2026 that a security incident had an estimated total impact of about US$6.3 billion, with about US$3 billion frozen on-chain so far (Binance, Security Incident Update). TRM Labs measured US$6.36 billion leaving Binance wallets on ten blockchains, most of it in about 20 minutes from 20:05 UTC on 29 October, and called it the largest crypto theft on record, about four times the US$1.5 billion Bybit theft of February 2025. Binance's initial investigation suggests it may have started with one engineer's laptop. Its later updates say the attack was more complex than that.

Quick answer. Binance says its initial investigation suggests a compromised DevOps engineer's laptop gave an attacker access to a service container, from which unauthorized withdrawals were submitted; it later found "additional points of breach" and has found no evidence of a wallet private key leak. TRM Labs attributes the theft with high confidence to North Korea's TraderTraitor, and Chainalysis and Elliptic also point to North Korea, but no government had confirmed attribution as of 30 October 2026. Binance says it will cover all losses from its SAFU fund and company funds. Stingrai's reading for exchanges is that this is a signing-path failure: a workstation should never be able to make a hot wallet sign, and threat-led red teaming is how you prove that it cannot.

Status as of 30 October 2026, about 13:00 UTC. Figures are moving. Binance has promised a detailed technical post-mortem once its investigation is complete, and an updated Proof of Reserves once remediation is complete. This post separates what Binance has stated, what researchers reported, and what remains unconfirmed, and we will add a dated update block when the post-mortem is published. Stingrai has no inside knowledge of Binance's environment; everything below comes from public statements and on-chain research.

TL;DR: the Binance hack in eight lines

• What happened: Attackers drained Binance hot wallets on 29 October 2026 from about 20:05 UTC, with a second wave around 23:05 UTC, across ten blockchains by TRM Labs' count and 11 by Elliptic's.

• How much (Binance): an estimated total impact of about US$6.3 billion (Binance).

• How much (researchers): US$6.36 billion (TRM Labs), about US$5.912 billion at time of theft (Chainalysis), US$6.43 billion (Elliptic).

• How (Binance's initial account): its initial investigation suggests the incident may involve a compromised DevOps engineer's laptop that gave an attacker access to a service container, where unauthorized withdrawals were submitted; a later update found additional points of breach; no evidence of a private key leak (Binance on X).

• How (researcher assessment): TRM Labs and Elliptic both assess that the attacker got Binance's own systems to sign transactions, rather than stealing keys.

• Who: TRM Labs names TraderTraitor "with high confidence"; Chainalysis has "a high degree of confidence that DPRK is responsible" (Chainalysis on X); no government has confirmed it.

• Frozen: about US$3 billion per Binance, including more than 1.567 billion USDT frozen by Tether and more than 800 million USDC frozen by Circle.

• Status for users: Binance says user funds are safe and it will cover all losses; deposits are unaffected; at 08:47 UTC on 30 October it said withdrawals were on track to resume in 45 hours.

Binance hack timeline (29 to 30 October 2026)

Every time below is UTC and comes from a timestamped primary source: Binance's own posts, its executives' posts, the stablecoin issuers, Chainalysis's posts, or TRM Labs' on-chain reconstruction (data to 00:30 UTC on 30 October).

Figure 1: How the Binance theft unfolded, 29 to 30 October 2026 (UTC). Sources: Binance, TRM Labs, Chainalysis.

Two details in that sequence matter for defenders. The stablecoin issuers froze the main receiving wallets within about an hour of the first outflow, before Binance's 21:24 UTC post. And Binance says the outflows "ceased when we paused withdrawal service earlier", which is consistent with the withdrawal service, rather than a stolen key, being the channel the attacker used.

What Binance has stated, what researchers reported, and what is still unknown

Incident coverage blurs three kinds of claim. Here they are kept apart.

Stated by Binance

Some of these are firm statements; the starting point is a preliminary finding that Binance itself hedges.

• Size: "The estimated total impact sits at around $6.3B," with about US$3 billion frozen on-chain with blockchain partners (Binance announcement).

• Starting point (initial finding): the initial investigation suggests the incident may involve "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container", where unauthorized withdrawal transactions were submitted.

• Not a single-step compromise: co-CEO Richard Teng wrote that "the attacker did not simply use one engineer's permissions", that it was not a "one-click" action, and that the investigation "has not attributed responsibility to any individual" (Richard Teng). Binance later said its investigation "has uncovered additional points of breach" (Binance).

• Keys: "We have found no evidence of any wallet private key leak."

• Response: withdrawals suspended while the team completes "a security revamp of the withdrawal service and its related addresses"; affected address authorizations revoked; law enforcement and blockchain intelligence partners engaged.

• Losses: "Binance will cover all losses from the SAFU fund and the company's funds." Deposits are unaffected.

Reported by blockchain analytics firms

• Mechanism: TRM Labs found that on Ethereum the attacker used EIP-7702 delegation, with 50 pre-signed authorizations, to turn a Binance hot wallet into a sweeper; on the other nine chains, Binance wallets sent funds through ordinary signed transfers. "In TRM's assessment, this points to a compromise of Binance's hot wallet signing infrastructure." Elliptic reached the same reading: the attacker "appears to have been able to get Binance's own systems to sign transactions on their behalf" (Elliptic).

• Preparation: TRM says "Preparation began at least 36 hours before the theft," and that the attacker's operator wallet received three small withdrawals from Tornado Cash starting the morning of 28 October.

• Attribution: TRM attributes the theft to TraderTraitor: "We make this judgment with high confidence." Chainalysis says it saw funds from the September 2026 Bitget exploit commingling with Binance funds. Elliptic attributes the theft to the DPRK but lists reasons for caution.

Not confirmed as of 30 October 2026

• How the laptop was compromised. Elliptic calls this "the most diagnostic fact still missing." Nothing public says whether it was a lure, a malicious package, a stolen session or something else.

• What the "additional points of breach" are. Binance has not said which systems, accounts or vendors they involve.

• Government attribution. Elliptic notes that "No government or law enforcement agency has confirmed attribution." The FBI named North Korea for Bybit; it had not done so for Binance at the time of writing.

• The final loss figure. The estimates differ by time of valuation and by which chains are counted.

• The date withdrawals resume, and whether every asset resumes at once.

How much was stolen in the Binance hack: the estimates compared

The four public figures do not conflict. They price the same outflows at different moments and over slightly different sets of chains.

By chain, TRM puts Ethereum at about US$3.79 billion and Bitcoin at 18,270 BTC (about US$1.47 billion), with Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon making up the rest.

How the Binance hack happened: the sequence so far

Binance has not yet published a root cause, and TRM notes that "Binance has yet to publish a root cause." What follows uses only Binance's statements and the on-chain record, in order, and marks which steps are Binance's preliminary findings and which are researcher assessments.

1. A DevOps workstation is the suspected starting point. Binance's initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop". How it was compromised is not public.

2. The attacker reached a service container. By Binance's initial account, the laptop gave the attacker access to "a service container", where the unauthorized withdrawal transactions were submitted.

3. The path involved more than one engineer's access. Teng's words, "not a single 'one-click' action" and "a more complex attack process", together with the later "additional points of breach", argue against the simplest reading: one engineer's standing permissions misused once.

4. Binance's own signing systems produced valid transactions (researcher assessment). On Ethereum, 50 EIP-7702 authorizations, each signed in advance by a Binance hot wallet, were submitted in a single transaction, delegating the wallet's account to a contract the attacker controlled, which then sent the wallet's entire balance to an attacker address: 167,464 ETH and 63 tokens, including 1.615 billion USDT, per TRM. EIP-7702 is a finalized Ethereum standard that lets an ordinary account set code for itself; the standard itself warns that "A poorly implemented delegate can allow a malicious actor to take near complete control over a signer's EOA" (EIP-7702). On the other chains, the wallets simply signed transfers.

5. No evidence the keys left. This is how Binance can say it found no evidence of a private key leak while losing billions. If an attacker can make a signing service sign, the key never has to leave the hardware. "Keys are safe" and "funds are safe" are different claims.

6. Binance says pausing withdrawals stopped the outflows. In its words, "The outflows ceased when we paused withdrawal service earlier." Binance has not said when the pause took effect on each network. TRM records a second wave around 23:05 UTC on Avalanche and Polygon, and further sweeps of the delegated Ethereum wallet as late as 23:56 UTC; Binance's first post announcing that all deposits and withdrawals were suspended came at 00:13 UTC on 30 October.

The fastest way to understand this incident is the gap between steps 2 and 4: a service that requests withdrawals was able to obtain signatures that the signing layer should have refused. Every root cause below is about that gap.

Root causes, read as control failures

Each cause below is labelled. Binance's initial finding means Binance stated it as a preliminary result ("suggests", "may involve"). Researcher assessment means TRM Labs or Elliptic concluded it from the chain. TraderTraitor lesson means it is documented in an official government or vendor account of an earlier TraderTraitor case and is not confirmed for Binance.

1. Developer and DevOps workstation trust (Binance's initial finding)

A DevOps engineer's laptop is an ideal first foothold: it holds cloud and cluster credentials, active sessions and the tooling that deploys production. Binance's initial investigation suggests the laptop was involved; Binance has not said how it was compromised. The control failure is not "an engineer clicked something". Engineers will click things. The failure is any design in which a single endpoint, once compromised, carries usable access toward the systems that move money. Session theft is a known TraderTraitor step: in the DMM Bitcoin case, the FBI says the actors "exploited session cookie information to impersonate the compromised employee" (FBI, DC3 and NPA).

2. A privileged path from the workstation to withdrawal and signing (Binance's initial finding)

Binance's initial account says the laptop led to a service container where unauthorized withdrawals were submitted. Two questions follow, and Binance's post-mortem should answer both. Why could that container be reached from an engineer's laptop? And why did the signing layer accept what the container submitted? A withdrawal service is supposed to ask; the signer is supposed to decide, against limits and policies it enforces on its own. Binance's chosen remediation, "a security revamp of the withdrawal service and its related addresses", points at exactly this boundary. Our guide to cloud IAM penetration testing covers how role chaining and service identities turn one foothold into this kind of path.

3. Hot wallet signing policy and exposure (researcher assessment)

Two researcher findings describe the signing layer. First, 50 EIP-7702 authorizations, each signed in advance by a Binance hot wallet, were submitted in a single transaction. A signing policy that rejected unexpected delegations, or treated a batch of authorizations across many nonces as abnormal, would have refused it. TRM's own recommendations say so directly: "Signing policies should reject EIP-7702 authorizations unless they are expected," and "A request for many authorizations across a range of transaction counts should be treated as an indicator of compromise." Second, the attacker obtained valid signatures for Binance wallets on ten chains within hours, most of them within about half an hour. TRM's advice that "Signing infrastructure and approval paths should be separated by chain and wallet tier" exists to stop exactly that blast radius. Neither point tells us Binance's actual policies; both tell every exchange what to check in its own.

4. Recruiter and job-offer lures (TraderTraitor lesson, not confirmed for Binance)

The US government has described TraderTraitor's opening move since April 2022. The FBI, CISA and Treasury advisory AA22-108A says the group sends recruitment-style spearphishing that offers "high-paying jobs to entice the recipients" into installing trojanized crypto applications, and that targets are "often working in system administration or software development/IT operations (DevOps)". In the DMM Bitcoin theft of May 2024, the FBI says an actor "masquerading as a recruiter on LinkedIn" sent an employee of the wallet software company Ginco a URL linked to "a malicious Python script under the guise of a pre-employment test located on a GitHub page". The same statement says TraderTraitor activity "is often characterized by targeted social engineering directed at multiple employees of the same company simultaneously." Nothing public says Binance was lured this way. A DevOps laptop is, however, precisely the target this tradecraft is built for. Our social engineering statistics collect the wider numbers on lure-led intrusions.

5. Supply chain into the signing path (TraderTraitor lesson, not confirmed for Binance)

Two earlier TraderTraitor thefts went through a supplier rather than the exchange. For Bybit, the Safe Ecosystem Foundation said its forensic review found that "a compromised Safe{Wallet} developer machine" led to "the proposal of a disguised malicious transaction", and that the review "did NOT indicate any vulnerabilities in the Safe smart contracts" (Safe Ecosystem Foundation). For DMM Bitcoin, the compromised employee worked at Ginco, the wallet software company, and the FBI says the actors "likely used this access to manipulate a legitimate transaction request by a DMM employee". The lesson for any custodian is that the signing path includes every vendor, library, interface and build pipeline that shapes a transaction before it is signed. Our analysis of the TanStack-to-Nx CI/CD compromise shows how one developer machine becomes the next project's initial access.

How the stolen funds moved and how they were frozen

Stablecoins were the attacker's weak point, because their issuers can freeze them. Elliptic found that "more than $2.6 billion in stablecoins was still in the attacker's wallets when issuers froze them."

• Tether: 971.1 million USDT frozen in the main receiving wallet at 21:01 UTC (TRM); Tether's CEO later put the total at more than 1.567 billion USDT.

• Circle: 823 million USDC frozen at 21:04 UTC (TRM); Circle says it acted "in coordination with law enforcement".

• Ripple and World Liberty Financial: froze the stolen RLUSD at 22:01 UTC and 27.8 million USD1 at 22:10 UTC (TRM).

• Arbitrum Security Council: moved 8,426 ETH and 74.6 million ARB, about US$30 million, out of the attacker's reach (TRM).

• Total frozen: about US$3 billion by Binance's count, roughly US$2.7 billion by TRM's, and US$2.84 billion verified by Elliptic.

The attacker moved fast on the rest. TRM says about 325 million USDT was "sold to professional fillers and market makers" at a discount of more than 10%, and that the attacker posted USDT on Aave and "borrowed about 19,760 ETH against it". What cannot be frozen is native ETH and BTC: TRM counts about US$2.4 billion "beyond any issuer's reach", and Elliptic counts about US$3.33 billion spread across around 43 addresses. TRM expects the next stage "to involve cross-chain bridges, swap services and over-the-counter brokers", which is why every exchange should now be screening deposits against the labelled attacker addresses.

Is the Binance hack the largest crypto hack ever?

Yes, by every published estimate. The previous record was Bybit: the FBI says North Korea was responsible for the "theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit" on or about 21 February 2025, and calls the activity TraderTraitor (FBI IC3 PSA I-022625-PSA). Chainalysis puts the Binance theft at "nearly 4x the amount stolen in the next largest crypto heist (Bybit, 2025)".

Figure 2: The Binance theft against earlier North Korea-linked crypto thefts, value at the time as stated by each source. Sources: Binance, FBI IC3, FBI, DC3 and NPA, Chainalysis on Bitget, Chainalysis on KelpDAO, TRM Labs on Drift.

Binance itself has been here before at a smaller scale. In May 2019 it announced that hackers withdrew 7,000 BTC from its BTC hot wallet, which held "about 2% of our total BTC holdings", and that it would "use the #SAFU fund to cover this incident in full" (Binance, May 2019). The 2026 incident repeats that promise on a far larger loss, and it reached hot wallets on ten chains rather than one. For the year's wider numbers, see our crypto hacking statistics for 2026.

How to protect yourself: exchanges, custodians and fintechs

Every control below maps to a fact Binance has stated, a researcher finding, or a documented TraderTraitor step. None depends on knowing Binance's internal design.

1. Cut the path from laptops to money. No engineering workstation, and no session issued to one, should be able to reach a service that can request withdrawals or signatures. Use dedicated privileged access workstations for production change, phishing-resistant MFA, and short-lived, device-bound sessions, so a stolen session cookie (the DMM Bitcoin step) is worth little off the original device.

2. Make the signer decide, not the requester. The signing layer should enforce its own rules: per-wallet and per-chain velocity and value limits, allowlisted destinations for hot-to-cold and hot-to-customer flows, and a hard stop on transaction types the business never uses. A service container that can submit withdrawals should only ever be able to ask.

3. Write EIP-7702 into the signing policy. Following TRM's guidance, reject EIP-7702 authorizations unless they are expected, alert on any delegation on a treasury wallet, treat requests for many authorizations across a range of nonces as an indicator of compromise, and keep "a tested, pre-approved method for signing a revocation".

4. Separate signing by chain and wallet tier. One compromised capability should not reach hot wallets on ten chains. Isolate signing infrastructure and approval paths by chain and tier, and cap hot wallet balances to what the next hours of withdrawals need.

5. Verify what is signed, not what is displayed. At Bybit, a disguised malicious transaction was proposed through a compromised wallet developer's machine. Decode and check the raw transaction on an independent system before any signature, and require out-of-band confirmation above set thresholds.

6. Harden engineers against recruiter lures. AA22-108A recommends security awareness training, application allowlisting, MFA and least privilege. Tell DevOps and system administration staff, by name, that "coding tests", trading tools and repositories sent by recruiters are the documented TraderTraitor entry point, and give them a fast, blame-free way to report one.

7. Bring wallet vendors and build pipelines into scope. Treat the wallet software provider, its interface and your CI/CD as part of the signing path, with access reviews, change monitoring and the right to test written into contracts.

8. Rehearse the freeze. The issuer freezes here came within about an hour. Keep current contacts at Tether, Circle and your other issuers and analytics partners, a runbook for pausing withdrawals by chain, and a pre-agreed way to publish labelled attacker addresses.

How threat-led penetration testing and red teaming validate these controls

A configuration review tells you a policy exists. A threat-led red team tells you whether it holds when someone who behaves like TraderTraitor is pushing on it. For an exchange or custodian, a useful scenario looks like this:

• Objective set on the crown jewel: "cause a production signer to sign a withdrawal outside policy", agreed in the rules of engagement and stopped at a pre-agreed proof point, never with real funds. Our guide to red team objectives and crown-jewel scoping covers how to write it.

• Threat intelligence from official sources: AA22-108A, the FBI's DMM Bitcoin and Bybit statements, and now this incident, turned into specific tactics, as described in which threat group your red team should emulate.

• Lure testing with consenting staff: a recruiter-style approach and a "coding test" delivered to DevOps volunteers, to measure reporting and detection rather than to embarrass anyone, through social engineering testing.

• Assumed breach on an engineering laptop: start where Binance's initial account says its attacker started and try to reach CI/CD, the container platform, cloud roles and the withdrawal service, through adversary simulation and cloud penetration testing.

• Signer policy tests: in a test environment, submit the requests a compromised service would send, including unexpected EIP-7702 authorizations and bursts across nonces, and confirm the signer refuses and the SOC sees it.

• Purple teaming afterwards: replay the chain with your detection team watching, so every missed step becomes a rule.

Stingrai is a CREST-accredited penetration testing company founded in Toronto in 2021. Its red teaming runs assumed-breach, black-box full-chain and threat intelligence-led scenarios (DORA and TIBER style) on premise and in the cloud, with purple teaming against real-world tactics alongside the client's SOC. Human-led engagements are staffed by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, and every human-led and hybrid report ships with an attestation letter. Both one-time (annual) engagements and continuous programs are available. For how threat-led programs are structured across regulators, see the global reference to threat-led penetration testing frameworks. For buyers comparing providers, our rankings of crypto and digital asset penetration testing companies and exchange and trading platform penetration testing companies set out what to ask.

Exchange checklist: today, this week, this quarter

Today

1. Screen deposits and counterparties against the attacker addresses that TRM Labs, Chainalysis and Elliptic have labelled.

2. Check every treasury and hot wallet on EVM chains for EIP-7702 delegations, and alert on any new one.

3. Confirm withdrawal-pause and per-chain kill switches work, and who can trigger them.

This week

1. Map every path from an engineering workstation to a service that can request a signature, and close the ones you cannot justify.

2. Add signer-side rules: reject unexpected EIP-7702 authorizations, flag batches of authorizations across nonces, enforce per-chain limits.

3. Brief DevOps and system administration staff on recruiter and "coding test" lures, with a one-click reporting route.

This quarter

1. Separate signing infrastructure and approval paths by chain and wallet tier, and right-size hot wallet balances.

2. Run a threat-led red team with a TraderTraitor-style scenario, from lure and assumed breach to an attempted out-of-policy signature, followed by a purple team replay.

3. Review wallet software vendors and CI/CD as part of the signing path, and test them.

How to protect yourself: individual Binance users

Big thefts are followed by a second wave of crime aimed at the victims' customers. Expect fake "refund", "compensation" and "SAFU claim" pages, fake support agents in direct messages, and recovery offers that ask for a fee. These steps help.

• Use only official channels. Binance's own instruction is: "Please rely only on official Binance channels for updates" (Binance on X). Type the address yourself or use the app; do not follow links in messages, ads or replies.

• Know what Binance has actually said about compensation. Binance says it "will cover all losses from the SAFU fund and the company's funds" and that user funds are safe. None of its statements up to 30 October 2026 asks users to submit a claim, connect a wallet, share a recovery phrase or pay a fee. Treat any page that does as a scam.

• Never share secrets. No genuine support agent needs your password, 2FA codes, recovery phrase or API secret keys.

• Lock down the account. Use a hardware security key or passkey for sign-in, enable withdrawal address allowlisting if your exchange offers it, and review API keys and connected devices.

• Do not sign what you do not understand. In your own self-custody wallet, refuse unexpected signature, approval or delegation requests, especially any that appear right after a news event.

• Ignore "fund recovery" firms. The FBI warns that fictitious law firms target crypto victims while offering to recover funds, that "There are no law firms which are officially authorized partners of US Government agencies," and that requests for payment in cryptocurrency or prepaid gift cards are a red flag (FBI IC3 PSA I-081325-PSA).

• Report scams. In the United States, report to the FBI at ic3.gov; in Canada, to the Canadian Anti-Fraud Centre.

Waiting is usually safer than acting. Deposits are unaffected, and Binance says withdrawals will resume after its security revamp; rushing to move funds through an unofficial "priority withdrawal" link is exactly what scammers are counting on.

Frequently Asked Questions

How did Binance get hacked?

Binance says its initial investigation suggests a compromised DevOps engineer's laptop gave an attacker access to a service container, from which unauthorized withdrawal transactions were submitted, and that a later investigation uncovered additional points of breach. It has found no evidence of a wallet private key leak. TRM Labs and Elliptic assess that the attacker got Binance's own hot wallet signing systems to sign transactions. Binance has promised a detailed technical post-mortem.

Who hacked Binance?

No government had named the attacker as of 30 October 2026. TRM Labs attributes the theft with high confidence to TraderTraitor, a North Korean hacking unit, and Chainalysis says it has a high degree of confidence that North Korea is responsible after seeing funds from the September 2026 Bitget theft commingle with Binance funds. Elliptic also attributes the theft to North Korea, while listing reasons for caution, including that the root cause has not been published.

How much was stolen in the Binance hack?

Binance puts the estimated total impact at about US$6.3 billion, with about US$3 billion frozen on-chain. TRM Labs measured US$6.36 billion leaving Binance wallets on ten blockchains, Chainalysis estimated about US$5.912 billion at the time of theft, and Elliptic counts US$6.43 billion across 11 blockchains. The differences come from when assets were priced and which chains were counted.

Is my money safe on Binance?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. Deposits are unaffected, and withdrawals were suspended while Binance revamps its withdrawal service. Binance has also said it will publish an updated Proof of Reserves once remediation is complete. Use only official Binance channels, because scammers are already exploiting the incident.

Will Binance users be reimbursed?

Binance says it will cover all losses from its Secure Asset Fund for Users (SAFU) and from company funds. Binance describes SAFU as an emergency reserve established in July 2018 that held crypto assets valued at about US$1 billion, entirely in Bitcoin, as of 2026, and Binance's pledge names both SAFU and company funds. None of Binance's statements up to 30 October 2026 asks users to file a claim or pay a fee.

When will Binance withdrawals resume?

At 08:47 UTC on 30 October 2026, Binance said it was on track to resume the withdrawal service in 45 hours, which points to early Sunday 1 November UTC. Co-founder and co-CEO Yi He had earlier said withdrawals were expected to resume within 48 hours. Binance later clarified that deposits are unaffected. Check Binance's official announcements for the actual restart.

Is the Binance hack the biggest crypto hack ever?

Yes. Every published estimate, from US$5.912 billion to US$6.43 billion, is several times the previous record, the theft of about US$1.5 billion from Bybit in February 2025 that the FBI attributed to North Korea's TraderTraitor. TRM Labs calls Binance about four times Bybit, and Chainalysis calls it nearly four times.

What is TraderTraitor?

TraderTraitor is the US government's name for a North Korean cyber activity cluster that steals cryptocurrency. A 2022 FBI, CISA and Treasury advisory describes recruitment-style spearphishing aimed at DevOps and system administration staff, and the FBI has attributed the 2024 DMM Bitcoin theft (US$308 million) and the 2025 Bybit theft (about US$1.5 billion) to it. It is also tracked as Jade Sleet and UNC4899.

Related reading

• Crypto Hacking Statistics 2026

• Best Penetration Testing Companies for Crypto Exchanges and Digital Asset Platforms 2026

• Best penetration testing companies for exchanges and trading platforms 2026

• Which threat group should your red team emulate, by industry

• Red teaming AI agents that move money in fintech

References

1. Binance. Security Incident Update (2026-10-30). 30 October 2026. https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7. Binance's estimate of impact and frozen funds, initial cause, private key statement, SAFU pledge and post-mortem commitment.

2. Binance. Posts on X, 29 and 30 October 2026. https://x.com/binance/status/2115917658680074294, https://x.com/binance/status/2115960292115124558 and https://x.com/binance/status/2116089661408108712. First notice, deposit and withdrawal suspension, and the additional points of breach update with the 45-hour withdrawal timeline.

3. Richard Teng (Binance co-CEO). Post on X. 30 October 2026. https://x.com/_RichardTeng/status/2116072080525656150. The laptop and service container account, and that the attack was more complex than one engineer's permissions.

4. Yi He (Binance co-founder and co-CEO). Service Update on X. 30 October 2026. https://x.com/heyibinance/status/2116021551262740985. Deposits unaffected; withdrawals expected to resume within 48 hours.

5. TRM Labs. North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History. 29 October 2026. https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history. On-chain reconstruction to 00:30 UTC on 30 October: amounts by chain, EIP-7702 sweep, freezes, laundering and attribution.

6. Elliptic. The largest theft in history: DPRK behind the $6.4 billion Binance hack. Updated 30 October 2026. https://www.elliptic.co/insights/binance-largest-hack-in-history/. Independent loss, freeze and attacker-holdings estimates, with attribution caveats.

7. Chainalysis. Posts on X. 30 October 2026. https://x.com/chainalysis/status/2115963516884808078 and https://x.com/chainalysis/status/2116025255965999217. Loss estimate at time of theft and DPRK attribution based on commingled Bitget funds.

8. Tether and Circle. Freeze statements by Paolo Ardoino and Jeremy Allaire on X. 29 October 2026. https://x.com/paoloardoino/status/2115918000373346709 and https://x.com/jerallaire/status/2115916207463481846. Stablecoin freezes linked to the incident.

9. FBI, CISA and US Treasury. TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (AA22-108A). 18 April 2022. https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a. TraderTraitor lures, targets and recommended mitigations.

10. FBI. North Korea Responsible for $1.5 Billion Bybit Hack (I-022625-PSA). 26 February 2025. https://www.ic3.gov/PSA/2025/PSA250226. Attribution of the Bybit theft to TraderTraitor and a request to block laundering addresses.

11. FBI, DC3 and National Police Agency of Japan. Identification of North Korean Cyber Actors, Tracked as TraderTraitor, Responsible for Theft of $308 Million USD from Bitcoin.DMM.com. 23 December 2024. https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom. The recruiter lure against a Ginco employee and the manipulated transaction.

12. Safe Ecosystem Foundation. February 28th, 2025: Statement by the Safe Ecosystem Foundation. 28 February 2025. https://safefoundation.org/blog/safe-ecosystem-foundation-statement. Forensic finding of a compromised Safe{Wallet} developer machine and a disguised malicious transaction.

13. Ethereum Improvement Proposals. EIP-7702: Set Code for EOAs. https://eips.ethereum.org/EIPS/eip-7702. The delegation standard used in the Ethereum sweep, with its security considerations.

14. Binance Academy. Secure Asset Fund for Users (SAFU). Updated 13 October 2026. https://www.binance.com/en/academy/glossary/secure-asset-fund-for-users. Origin and stated size of the SAFU fund.

15. Binance. Binance Security Breach Update. 7 May 2019. https://www.binance.com/en/support/announcement/360028031711. The 2019 theft of 7,000 BTC from a hot wallet, covered by SAFU.

16. Chainalysis and TRM Labs. Bitget, KelpDAO and Drift theft analyses. 2026. https://www.chainalysis.com/blog/387m-bitget-theft-2026/, https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/ and https://www.trmlabs.com/resources/blog/north-korean-hackers-attack-drift-protocol-in-285-million-heist. Amounts and attribution for the comparison chart.

17. FBI. Fictitious Law Firms Targeting Cryptocurrency Scam Victims Combine Multiple Exploitation Tactics While Offering to Recover Funds (I-081325-PSA). 13 August 2025. https://www.ic3.gov/PSA/2025/PSA250813. Recovery-scam red flags for victims of crypto theft.

Talk to Stingrai

If your platform holds hot wallets, the question this incident raises is whether a compromised engineering laptop could make your signer sign. A threat-led red team can answer it before an attacker does: Get a Quote or book a free discovery call.