1. Basic Information

2. Executive Summary

The FBI has attributed the theft of over $6 billion in cryptocurrency from Binance, which occurred around October 29, 2026, to the North Korean threat group TraderTraitor. While Binance stated it had found no evidence of hot-wallet private key leakage, it is investigating a potentially compromised DevOps endpoint and additional entry vectors. TRM Labs observed sweeper activity using pre-signed EIP-7702 authorizations on Ethereum along with standard signed transfers across nine other chains, assessing the incident as a compromise of hot-wallet signing infrastructure, though Binance has not yet determined the final root cause.

Approximately $6.3 billion was transferred out of wallets across 10 blockchains in a short timeframe. The FBI attributed the theft to North Korea; separately, the signing and approval infrastructure is suspected to have been compromised. Binance’s coverage of customer balances and the freezing of stolen assets do not mean all funds have been recovered from the attacker.

3. Attack Flow

Preparation, Internal Access, and Signature Acquisition

  1. TRM Labs analysis indicates that at least 36 hours prior to the theft, funding was acquired via Tornado Cash, followed by contract deployment, testing, and rehearsal.
  2. Binance is investigating whether service containers were accessed via a potentially compromised DevOps laptop. Binance also reported that its subsequent investigation had uncovered additional points of breach; the full initial-access sequence and root cause remain unconfirmed.
  3. TRM Labs notes that 50 EIP-7702 authorizations were pre-signed for Ethereum while standard-format signed transfers were used on other chains. They assess that the most plausible explanation is that attackers gained the capability to induce the hot-wallet signing infrastructure to sign unauthorized transactions.

Asset Transfers Across 10 Blockchains

  1. Starting around 20:05 UTC on October 29, 2026, assets were transferred from Binance wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana, and other chains to attacker-controlled addresses. TRM Labs reported that the primary transfers took place in about 20 minutes, with a subsequent wave reaching Avalanche and Polygon around 23:05 UTC.
  2. On Ethereum, EIP-7702 delegation was used to turn the Binance hot wallet into an attacker-controlled sweeper to transfer tokens.
  3. Standard signed transfers were used on the other nine chains, meaning Ethereum EIP-7702 delegation abuse alone does not account for the thefts across all chains.

Tracing, Freezing, and Money Laundering

  1. The FBI, USSS, and IRS-CI observed TraderTraitor converting the stolen assets primarily into ETH, and anticipate further laundering using DeFi and instant swap services.
  2. Token issuers and network participants froze stablecoins and assets on certain chains. According to TRM Labs, approximately $2.7 billion was frozen as of 00:30 UTC on October 30, while attackers retained ETH and BTC which issuers cannot freeze.
  3. Binance announced plans to begin a phased resumption of withdrawals between 06:00 and 09:00 UTC on November 1, stating that approximately 95% of the affected amount was covered using corporate funds. This replenishment percentage is distinct from the proportions of stolen assets frozen or recovered.

4. Attacker Positioning and Execution Location

  • Attackers may have gained unauthorized access to Binance's hot-wallet signing infrastructure or connected internal services. Specific privileges, credentials, and the pathway from endpoint to signing processes remain unconfirmed.
  • Asset transfers and subsequent swap and DeFi operations were executed across multiple public blockchains, leaving traceable on-chain activity.

5. Victim and Administrator Perspective

Victims

  • Binance has stated that user balances will be covered by the company and that deposit services remain unaffected. Meanwhile, withdrawals were temporarily paused, with a phased resumption scheduled for November 1 between 06:00 and 09:00 UTC. Actual availability must be verified via official network and asset status channels.

Administrators

  • Internally, indicators may include unauthorized access to DevOps endpoints or service containers, unusual signing requests, large-scale withdrawals across multiple chains in a short window, EIP-7702 authorizations, and urgent authorization revocations.
  • On-chain activity may appear as mass transfers from Binance-attributed wallets to new addresses, stablecoin swaps, DeFi loans, and the consolidation of assets into ETH.

6. Success and Failure Conditions

Success Conditions

  • Attackers successfully obtain valid signatures or authorizations from the hot wallet.
  • Signed transactions can be broadcast to each chain without being blocked by approvals, policies, rate limits, or anomaly detection prior to execution.
  • In the EIP-7702 path, authorizations meeting chain ID and nonce conditions are processed on-chain alongside valid signatures from the target EOA. Delegation to attacker-controlled code is a built-in protocol feature and does not imply a vulnerability in EIP-7702 itself.

Failure Conditions and Mitigations

  • Isolate signing infrastructure by chain and wallet tier to prevent a single endpoint or service compromise from propagating across multiple chains.
  • Enforce independent policy checks or manual reviews to block EIP-7702 delegations, new contract code, out-of-bounds authorization batches, and anomalous destinations, amounts, or velocities.
  • Verify transaction simulation, approval identities, devices, service identities, and the content of signing requests, beyond merely protecting signing key confidentiality.
  • Because EIP-7702 signed authorizations can be included in transactions by third parties, internal withdrawal halts alone cannot stop pre-signed authorizations from being used on-chain. One way to clear an active delegation is to have an authorization signed by the target EOA, with the delegate set to the zero address, successfully processed on-chain under the applicable chain ID and nonce conditions. Account for any remaining pre-signed authorizations and nonces; broadcasting a transaction alone does not establish that the delegation has been cleared.
  • Establish pre-arranged emergency freezing and blocking procedures with issuers, node operators, exchanges, and blockchain analytics firms.

7. What Happens Upon Success

  • Assets across multiple chains are transferred from hot wallets to attacker-controlled addresses.
  • TRM Labs observed stablecoin exchanges and borrowing on DeFi platforms. Future laundering via DeFi and instant swap services mentioned by the FBI should be treated as projections.
  • Response actions include stopping withdrawals, covering affected balances, moving to replacement wallets, revoking affected authorizations, and coordinating freezes with asset issuers and networks.

8. Observable Logs

Inference: The following are candidate logs to investigate within your organization. They depend on logging configurations, retention settings, and wallet architecture, and do not imply that all Binance logs have been verified in primary sources.

  • Email: Look for phishing or approval requests masquerading as emergency approvals, signing policy changes, or incident coordination.
  • Proxy / SWG / DNS: Check for anomalous traffic between DevOps endpoints, wallet/signing services, RPC nodes, contract deployment endpoints, and DeFi or instant swap services.
  • Endpoint / EDR: Check DevOps endpoints for credential access, remote execution, service token usage, and container management actions. The specific endpoint compromise method remains unconfirmed; do not assume an intrusion vector described in an unrelated incident.
  • Identity / IdP: Review sessions for DevOps and wallet operators, service accounts, MFA status, privilege elevations, token issuers, and device attributes.
  • SaaS / Cloud: Check for access to service containers, secret retrieval, CI/CD and repository actions, signing API requests, policy changes, and authorization revocations.
  • Network: Correlate RPC submissions, high-value multi-chain transfers, new destinations, short-duration bursts, stablecoin swaps, and DeFi loans with on-chain data.
  • Wallet Signing: Review request payloads, transaction simulations, chain IDs, nonces, recipients, amounts, EIP-7702 authorizations, approvers, HSM/MPC participants, and signature outputs.

9. Determining Attack Success

Asset theft has been confirmed through statements by the FBI and Binance, while specific procedures for initial access and signature acquisition remain under investigation.

  • Follow-on Compromise Confirmed: Public Information: Binance confirmed the unauthorized transfer of approximately $6.3 billion worth of assets from hot wallets on October 29, 2026, and the FBI, USSS, and IRS-CI observed the conversion of stolen assets into ETH. Because private key theft has not been confirmed and further laundering via DeFi and instant swap services remains prospective, the full internal compromise path and all subsequent stages have not been confirmed. Target: Binance hot wallets / 10 blockchains / attacker-controlled addresses

10. Investigation Playbook

Inference: Recommended investigation steps for your organization.

  • Trigger: Unexpected EIP-7702 delegations, simultaneous multi-chain withdrawals, bursts of signing requests, high-value transfers to new destinations, or anomalous access from DevOps endpoints to wallet services.
  • Initial Checks: Preserve target wallets, chains, transaction hashes, timestamps, recipients, amounts, approval records, signers, service identities, and preceding policy or code changes.
  • Endpoint: Preserve memory, EDR logs, browser and developer tools, repositories, credential access artifacts, and remote sessions on DevOps and wallet operator terminals. Do not treat reported intrusion vectors as confirmed facts; evaluate multiple hypotheses in parallel.
  • Identity/Cloud: Chronologically review tokens, MFA status, roles, container access, secret retrieval, CI/CD activity, and HSM/MPC participation for user and service accounts, and revoke potentially compromised authorizations.
  • Follow-on: Trace swaps, bridges, DeFi loans, mixers, instant exchanges, and derived addresses via on-chain analysis to verify relationships with addresses published by the FBI.
  • Containment: Halt withdrawals and signing operations on a per-chain basis, move to replacement wallets, review signing policies, and reissue service credentials, and request blocks/freezes from issuers, node operators, and exchanges.
  • Classification: Record endpoint compromise, service/container access, signature acquisition, transaction broadcasts, asset transfers, money laundering, freezing/recovery, and customer balance coverage as distinct phases.

11. Defense and Detection Ideas

  • Single Event: Block EIP-7702 delegations to hot wallets, unapproved code, policy-violating recipients, and signing requests exceeding normal thresholds.
  • Time Series: Correlate anomalies in DevOps identities, container/secret access, increased signing requests, simultaneous multi-chain transfers, and subsequent swap/DeFi operations.
  • Hunting: Search for FBI-published addresses and derived transactions, EIP-7702 authorization batches, new recipients, and unusual chain/asset combinations.
  • Logging Gaps: Valid signatures on-chain do not establish who obtained them or through which internal path; wallet, identity, and endpoint telemetry is needed to determine that.
  • Priority Controls: Prioritize signing separation by wallet tier and chain, transaction simulations, out-of-band approvals, value/velocity limits, default-deny EIP-7702 policies, and emergency revocation and freezing procedures.

12. Facts / Inference / Hypothesis

Facts

  • The FBI attributed the theft of over $6 billion in cryptocurrency from Binance on or around October 29, 2026, to North Korea, referring to the activity as TraderTraitor.
  • The FBI, USSS, and IRS-CI observed stolen assets being converted primarily into ETH and requested private sector entities to block related addresses and derived transactions.
  • Binance disclosed an impact of approximately $6.3 billion and stated there is no evidence that hot-wallet private keys were leaked. While investigating a potentially compromised DevOps laptop and service containers, Binance has not finalized a root cause, reporting that additional points of breach had been uncovered.
  • TRM Labs tracked transfers across 10 blockchains, identifying 50 pre-signed EIP-7702 authorizations on Ethereum and standard signed transfers across nine other chains.
  • TRM Labs assessed that the most plausible explanation is that attackers gained the ability to induce hot-wallet signing infrastructure to sign unauthorized transactions. This represents TRM Labs' analysis rather than a root cause finalized by Binance.
  • Binance announced plans to begin a phased resumption of withdrawals between 06:00 and 09:00 UTC on November 1, 2026, and stated it covered approximately 95% of the affected amount. Replenishing assets to cover customer balances is distinct from recovering stolen assets from attackers.

Inference

  • Inference: Even if private keys themselves are not leaked, equivalent asset transfers can occur if attackers can cause legitimate signing services to sign unauthorized transactions. The absence of key leak evidence does not rule out a compromise of the signing workflow.
  • Inference: Because standard-format signed transfers occurred simultaneously across multiple chains, disabling EIP-7702 alone would not prevent multi-chain compromises of this nature.

Hypothesis

No additional hypotheses. Unconfirmed items are documented under Unknowns and Limitations.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1657 Financial Theft high The FBI and Binance confirmed the theft of over $6 billion in cryptocurrency. Because initial access methods remain unconfirmed, credential or supply chain techniques are not assigned by assumption.

14. Unknowns and Limitations

  • Initial access, compromised identities and credentials, the pathway from DevOps endpoints to service containers and signing processes, and additional entry vectors remain unconfirmed.
  • Binance's final root cause report has not been published. The approval and signing workflows used to generate the EIP-7702 authorizations are unknown.
  • The specific endpoint compromise methods in the Binance incident and the exact scope of networks and assets enabled for withdrawal cannot be determined solely from referenced public disclosures.
  • Frozen amounts, attacker-held balances, and replenishment percentages vary by timestamp and asset valuation. Track customer balance coverage, frozen assets, recovered assets, and balances not yet transferred separately.

15. Impact on SOCs and Organizations

Organizations managing crypto assets, payments, or treasury operations must monitor systems under the assumption that legitimate signing infrastructure could sign unauthorized transactions, going beyond traditional key leak defenses. It is critical to inspect EIP-7702 delegations, simultaneous multi-chain signing requests, and anomalies in amounts, velocities, recipients, and asset types prior to signature generation, while correlating wallet, identity, endpoint, container, and on-chain telemetry on a unified timeline. Organizations should exercise emergency shutdowns, authorization revocations, wallet rotations, and freeze requests with issuers and exchanges, and report customer balance coverage and asset recovery using separate metrics.

16. Summary by Role

  • SOC: Chronologically correlate DevOps identities, container access, signing requests, EIP-7702 delegations, multi-chain transfers, and subsequent swaps.
  • Administrators: Isolate signing infrastructure by chain and wallet tier, and implement transaction simulations, out-of-band approvals, value/velocity limits, and emergency revocations.
  • Users: Check Binance official status pages and withdrawal resumption terms, and refrain from entering wallet recovery phrases or credentials in response to opportunistic phishing or communications purporting to offer asset recovery.