Binance finds more breach points in $6 billion hack beyond employee laptop
In brief
- Binance said investigators found more breach points beyond a suspected compromised employee laptop.
- About $6 billion moved across 10 blockchains, mostly within 20 minutes, according to TRM Labs.
- Binance said it froze about $3 billion and pledged to cover losses through SAFU.
- North Korea-linked TraderTraitor was responsible, TRM Labs said with high confidence.
From one laptop to several breach points
In an earlier Oct. 30 security update, Binance said its preliminary investigation identified a DevOps engineer's laptop that was potentially compromised, according to CryptoSlate's report. The laptop may have let an attacker access an internal service container and start unauthorized withdrawals (that was the working theory, anyway).
It's no longer the whole picture.
Binance now says there's more than one breach point. It hasn't said where they are.
How TRM Labs says the funds moved
According to TRM Labs' Oct. 29 investigation, as reported by CryptoSlate, attackers moved about $6 billion from Binance-associated wallets across 10 blockchains, and most of the assets moved within about 20 minutes. The affected networks included Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. TRM found the attackers began preparing at least 36 hours before the theft, making preliminary transactions and deploying malicious code ahead of the main withdrawals.
On Ethereum, TRM said the attacker used EIP-7702 to hand control of a Binance hot wallet to a malicious contract. The operation involved 50 pre-signed authorizations; one of them let the attacker install transaction-execution instructions and then drain the wallet. Wallets on other chains made ordinary transactions with valid signatures. TRM said the coordinated activity across different networks and signing systems pointed to a possible compromise of Binance's hot-wallet signing infrastructure.
TRM Labs said it was highly confident that TraderTraitor was responsible, CryptoSlate reported. That's a North Korea-linked group previously implicated in the $1.5 billion Bybit exploit in February 2025. The firm cited blockchain activity and off-chain intelligence, including similarities in how the attack was prepared and how stolen assets were moved.
Blockchain investigator ZachXBT reported that funds from the Binance exploit and September's Bitget hack of about $388 million passed through THORChain and were mixed at the same Ethereum address, per CryptoSlate. He suggested the same actor was likely behind both, noting Bitget had already been attributed to TraderTraitor. MistTrack separately reported that stolen TRX passed through Bitget Wallet's cross-chain bridge before reaching an Ethereum address previously linked to the Phemex hacker.
What Binance says it's doing
Binance said it revoked the affected address authorization and is overhauling its withdrawal infrastructure. The exchange said it has frozen about $3 billion in affected assets by working with blockchain partners, and it pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and corporate resources.
Deposits weren't affected, according to Binance's latest Oct. 30 update, and the exchange said it expected withdrawals to resume in 45 hours. It also plans to publish an updated proof of reserves after remediation.
Frequently asked questions
Who does TRM Labs say is behind the Binance hack?
TRM Labs said it was highly confident that TraderTraitor was responsible. TraderTraitor is a North Korea-linked hacking group previously implicated in the $1.5 billion Bybit exploit in February 2025. TRM cited blockchain activity and off-chain intelligence, including similarities in attack preparation and the use of pre-signed authorizations.
How did the attacker drain Binance's Ethereum hot wallet?
TRM said the attacker used EIP-7702 to hand control of a Binance hot wallet to a malicious contract. The operation involved 50 pre-signed authorizations, and one of them let the attacker install transaction-execution instructions and then drain assets from the wallet.
