Binance Incident Analysis

Context

On 29 October 2026, Binance hot wallets on at least eight chains sent about $6.3 billion to attacker addresses, most of it within 35 minutes: the largest crypto theft on record. Binance’s 3 November initial report traces the intrusion to a fake recruiter’s coding assignment, an internal AI tool and a stolen container deployment token, which let a malicious container reach the wallet signing service. Binance has found no evidence of a private-key leak, and the FBI has attributed the theft to North Korea’s TraderTraitor. A full post-mortem is still pending, so this analysis labels each finding by its basis and will be updated as further findings are published.

Key takeaways

1. 1The signer did what a trusted service asked. A malicious container reached the signing service, and wallets on at least eight chains signed the attacker’s transfers, along with 50 EIP-7702 authorizations that let one call take about $2.5 billion from Binance 14. Signers should reject transaction types withdrawals do not need, and accept a transfer only when it matches an independent withdrawal record.
2. 2Containment came mostly from outside Binance. About $6.07 billion had left before its first public statement, 71 minutes after the first outflow, and the delegation on Binance 14 stayed live for almost four hours. Almost all of the roughly $3 billion frozen was stopped by stablecoin issuers. In our assessment, an automated emergency stop and capped hot-wallet balances could have materially reduced the loss.
3. 3Engineers’ devices are now a path to the signer. The entry point matches DPRK’s fake-hiring campaign, and an internal AI tool spread access between engineers’ computers. Some proceeds were laundered alongside Bitget funds; if one group carried out both, it emptied two major exchanges’ hot wallets in five weeks. Exchanges should remove standing credentials from laptops and treat internal AI tools as privileged systems.

Contributors

• Eni HsiungOneInfinity
• Rex ZhangOneInfinity