Binance Hot-Wallet Theft: About $6.3 Billion Moved Across Ten Blockchains

Updated October 30, 2026, 2:30 AM CT. On the afternoon of October 29, 2026, about $6.3 billion in digital assets moved out of Binance hot wallets on ten blockchains, the largest theft of digital assets on record. Binance says a compromised DevOps engineer's laptop may have let an attacker reach a service container that could submit unauthorized withdrawal transactions, that it found no evidence that private keys leaked, and that it will cover all losses. TRM Labs attributes the theft, with high confidence, to North Korea's TraderTraitor. This page lists what is verified and what is not. Cloudskope's analysis is in Binance Says No Private Keys Leaked. Its Own Hot Wallets Signed the $6.3 Billion Theft.

Timeline (Central Time)

• April 2022. FBI, CISA and Treasury advisory AA22-108A warns that TraderTraitor targets crypto company employees in DevOps, IT and system administration roles with fake recruiter approaches.
• October 27, 2026. Binance says it blocked multiple North Korea-linked fake-interview attacks on its developers and engineers in the previous week, with no losses (per published summaries).
• October 28, 2:39 AM. The attacker's operator wallet receives its first Tornado Cash withdrawal (drk; CertiK). First contract deployed at 9:28 PM.
• October 29, 8:51 AM to 1:20 PM. Rehearsals on test accounts, final contract at 10:59 AM, gas top-up at 1:20 PM.
• October 29, 3:04 to 3:09 PM. Five Binance XRP Ledger wallets send about 233.46 million XRP to an attacker address (TRM).
• 3:20:06 PM. 18,270.2 BTC leaves a Binance hot-wallet address in eleven transactions in Bitcoin block 973,732 (verified by Cloudskope).
• 3:20:59 PM. One Ethereum transaction carries 50 EIP-7702 authorizations signed with the key of the Binance 14 hot wallet, delegating it to attacker code (verified).
• 3:22:45 PM. 612.7 million USDT leaves a Binance Tron hot wallet (verified).
• 3:24:23 PM. Binance 14 is swept: 167,464 ETH and 63 tokens. At 3:24:47 PM, Binance 16 signs nine ordinary transfers to the attacker (verified).
• 3:41:23 PM. 780 million USDC moves from a Binance smart-contract wallet through the delegated Binance 14 (verified).
• 4:04 PM. Circle freezes 823 million USDC. Tether freezes begin at 4:01 PM (CertiK).
• 4:48 PM. Yi He, Binance co-founder, to The Block: "We are aware of reports of a potential security issue and we are actively investigating."
• About 5:15 PM. Withdrawals halted (FinanceFeeds). Tether blacklists Binance 14 itself at 5:06 PM (CertiK).
• 7:10:35 PM. Binance revokes the Binance 14 delegation, 3 hours 49 minutes 36 seconds after it was installed (verified).
• 7:13 PM. Binance: "all deposits and withdrawals are temporarily suspended."
• 7:30 PM. About $2.7 billion frozen by issuers and others (TRM).
• Late October 29 / October 30 UTC. Binance names a compromised DevOps engineer's laptop and a service container; no evidence of leaked private keys; about $3 billion frozen; losses covered from SAFU and corporate funds. Yi He says withdrawals should resume within 48 hours (11:17 PM).

What is unknown

• When the laptop was compromised and how.
• What the service container could reach, and whether any policy layer sat between it and the signing service.
• Why one submission produced 50 signed EIP-7702 authorizations, a transaction type that is not a withdrawal.
• Binance's own list of affected networks, addresses and amounts.
• Whether any customer withdrawal or balance was affected.
• Which regulators Binance notified, and when.
• Whether the compromised engineer was targeted by the campaign Binance described on October 27.
• How Binance will fund losses beyond SAFU (about 15,000 BTC).
• Government attribution.

Stated by Binance

• A compromised DevOps engineer's laptop may have enabled an attacker to reach a service container that could submit unauthorized withdrawal transactions.
• No evidence that wallet private keys were leaked. Authorization for the affected address revoked. Binance later said multiple factors contributed.

Confirmed by Cloudskope's direct observation (October 30, 2:00 to 2:20 AM CT)

• Ethereum transaction 0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b (block 26,300,753) is a type-4 transaction with 50 authorizations, nonces 18,914,775 to 18,914,824, all delegating Binance 14 to 0x63e842B054Bd624a465454D533C33F573e9c6fAe, sent by 0x7C8601d4645b93cea45F71e118A729332e6B5CA0.
• Binance 16 sent nine ordinary signed transfers to the attacker's collection wallet at 3:24:47 PM CT.
• Binance 14 kept sending ordinary transfers for about thirteen minutes after delegation; the delegation was cleared at 7:10:35 PM CT.
• The collection wallet 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c holds 1,175,464,712.88 USDT and 823,000,000 USDC, blacklisted by Tether and Circle. Binance 14 itself is also blacklisted by both.
• Bitcoin: 18,270.2 BTC to bc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm in block 973,732, now spent. Tron: 312,729,468 USDT frozen at TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi.

Assessed by others

• TRM Labs: most likely compromise of Binance's hot-wallet signing infrastructure; attribution to TraderTraitor with high confidence.

For funds trading on centralized exchanges, a withdrawal halt is a liquidity event; know exposure by venue and entity within an hour. In diligence of fintech, payments and custody targets, request the signing architecture, the exported signer policy, and the time from an unexpected change to a production wallet or payment queue to a human alert. Treat hot-wallet ratios and loss reserves as balance-sheet items.