Threat watch / Attack
Binance: about $6.3 billion taken from hot wallets
On October 29, attackers used Binance's own withdrawal system to move about $6.3 billion out of its hot wallets. Binance traces the entry to a months-long campaign against its wallet engineers, and says it covers the losses, not its users.
- Sector
- Finance
- Way in
- Phishing, social engineering
- Product or vendor
- None named
- How it happened
- According to Binance's initial report: in June a wallet DevOps engineer downloaded a tampered Homebrew while looking for an AI coding tool; in September a second engineer was approached by a fake recruiter and asked to run a coding "assignment" hiding a malicious repository with a zero-day; on October 20 the attackers used an internal AI tool to take over two more wallet engineers' systems; on October 29 they deployed a container with the first engineer's credentials and reached an internal wallet signing service. Binance: "It was not a single isolated breach or a simple phishing incident."[2] Checked 8 Nov 2026
- What was stolen
- About $6.3 billion in crypto-assets from 17 hot wallets, including stablecoins, ETH, BTC, XRP, SOL and OP. SecurityWeek gives $6.34 billion. About $2.7 to $3 billion was frozen, figures vary by source and date. Binance says it found no evidence of private key leaks.[1][2] Checked 8 Nov 2026
- Who was impacted
- Binance itself. It says it will "cover all losses" and that user funds are safe. Deposits and withdrawals were suspended on October 30. Co-CEO Richard Teng says 98% of the affected tokens have been replenished.[1][2] Checked 8 Nov 2026
- Threat actor
- TraderTraitor →
Timeline
- Binance's withdrawal system signs away about $6.3 billion from 17 hot wallets in just under four hours (21:04 to 00:56 CET), according to Bitquery as cited by Euronews. [1]
- Binance suspends deposits and withdrawals, says it will cover all losses, and reserves $6.34 billion. Tether and Circle freeze part of the funds. [1]
- TRM Labs attributes the heist to TraderTraitor, a North Korean group, "with high confidence". [1]
- Binance publishes its initial incident report: a months-long campaign against wallet engineers, through a tampered Homebrew, a fake job interview and an internal AI tool. [2]
- SecurityWeek reports that the FBI blames the theft on TraderTraitor. North Korea rejects the attribution. [2]
- BleepingComputer reports a separate claim: a seller on a new underground forum, believed to impersonate the ShinyHunters gang, offers what it says are records of 335 million Binance users for $900,000. Binance says it found "no evidence" that its systems, customer KYC data, account credentials, wallet private keys or internal infrastructure were compromised, and that the listing is likely a scam. [3]
- Elliptic updates its laundering analysis: $6.43 billion was stolen on October 29, $2.85 billion has been frozen or seized, around $3.0 billion remains in addresses linked to the theft, and "a negligible amount" has likely been cashed out. Elliptic says the funds are "very likely still held by North Korea". [4]
- The US Justice Department says members of the North Korean military, referred to by the FBI as TraderTraitor, stole more than $6 billion from Binance on or about October 29. US government and private sector efforts have frozen more than $2.7 billion, and the department has obtained court authorization to seize or restrain more than $1.2 billion of that. Efforts to trace, freeze, seize and forfeit the rest are ongoing. [5]