Overview
- Binance had about $6.3–$6.36 billion drained from its hot wallets on October 29, 2026 when attackers emptied accounts across more than ten blockchains in roughly 20 minutes.
- U.S. authorities and multiple blockchain‑analysis firms attribute the theft to a North Korea‑linked group called TraderTraitor and say the intruders had internal access for weeks before the October 29 drain.
- Investigators say the attackers used fake recruitment interviews, tampered developer tooling and compromised engineer devices to reach wallet signing systems rather than stealing private keys directly.
- The thieves weaponized an Ethereum delegation feature (EIP‑7702) to bundle transactions cheaply — reportedly paying about $15 to enable a roughly $2.5 billion move — and security firms say this amplified the damage.
- Industry responses have frozen roughly $2.7–$3.0 billion in stablecoins, Binance has replaced about 95–98% of affected assets from company reserves, and analytics firms report about $3.1 billion still in theft‑linked addresses undergoing automated laundering including recent THORChain swaps into BTC.