Threat reportData BreachTL-2026-4799
Binance security incident: compromised DevOps engineer laptop leads to service container access and ~$6.3 billion in unauthorized withdrawals
Binance security incident (TL-2026-4799), also tracked as Binance $6.3 billion hack, is a critical-severity data breach, first published 2026-10-30 and last reviewed 2026-10-31. It is attributed to TraderTraitor (North Korea) with medium confidence, affects Binance Binance centralized exchange withdrawal infrastructure, maps to 7 MITRE ATT&CK techniques (T1020, T1078, T1195.002), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 1TraderTraitor
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-4799
- Threat ID
- TL-2026-4799
- Also known as
- Binance $6.3 billion hack, Binance DevOps laptop compromise
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution
- TraderTraitor
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
- Updates
- 2026-10-31 · 5 updates · revalidated 5× · latest source
How Binance security incident works
On 2026-10-29 Binance disclosed a security incident that its preliminary investigation attributes to a compromised DevOps engineer's laptop, which let an unidentified attacker reach a service container and submit unauthorized withdrawal transactions. Estimated impact is about $6.3 billion, roughly $3 billion was frozen on-chain, Binance reports no evidence of wallet private key compromise and has pledged to cover all user losses.
Binance announced late on Thursday 2026-10-29 (US time; CoinDesk puts the start of the breach at about 4:30 p.m. ET) that it was investigating a potential security issue. It halted trading, deposits and withdrawals. In its preliminary findings (published 2026-10-30 10:26 per ChainCatcher) Binance stated that the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. Binance said it found no evidence of any wallet private key leak and that its BNB exchange balance was untouched.
Reported impact grew during the incident: an initial freeze figure of $2.5 billion, press estimates between $2.7 and $5.8 billion, and a final estimate of about $6.3 billion, which would make this the largest crypto theft on record. One outlet reported a breakdown of about $1.66 billion USDT, about 17,985 BTC (about $1.45 billion), $767 million USDC, plus ETH and other altcoins. This breakdown comes from a single outlet and was not corroborated elsewhere. About $3 billion was frozen through partner action: Tether froze about $1.567 billion USDT, Circle more than $800 million USDC, Ripple about $200 million RLUSD, World Liberty Financial about $27 million USD1 plus $2 million in tokens, and the Arbitrum Security Council froze 74.56 million ARB. Aave froze lending markets to prevent borrowing against stolen assets. Binance revoked authorization of the affected addresses and is working with law enforcement and blockchain intelligence firms.
How the attacker obtained access to the engineer's laptop has not been disclosed. The Register notes that the scant details make it hard to rule out a successful phishing attack or a supply chain attack on a package the developer used; neither is confirmed. The Arkham Intelligence CEO raised possible abuse of Ethereum's EIP-7702 delegation feature, but this was explicitly speculative and the investigation is ongoing. Some blockchain analysts suggested the Lazarus Group as a likely culprit (reported by CoinDesk); no authority or Binance has attributed the incident, and Arkham describes the attacker as unidentified. A separate third-party breach at Polymarket was reported the same week and is not shown to be linked.
The publicly described chain is therefore: endpoint compromise of a privileged DevOps engineer, then access to a service container that could initiate withdrawals, then submission of unauthorized withdrawal transactions across multiple chains and assets. Binance has promised a detailed technical review and a proof-of-reserves update once the investigation is complete. No CVEs, malware names, hashes or network IOCs have been published. The IOC list therefore contains behavioral and entity indicators only and must be updated when Binance publishes its post-mortem.
MITRE ATT&CK techniques used in TL-2026-4799
Exfiltration
Initial Access
T1078 Valid Accounts; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566 Phishing
Resource Development
T1587.001 Develop Capabilities: Malware
Execution
T1609 Container Administration Command
Impact
Affected products and versions in Binance security incident
- Binance — Binance centralized exchange withdrawal infrastructure (service container)
Vulnerable versions: Unspecified
Remediation for Binance security incident
Immediate actions
- Treat engineer and DevOps endpoints with access to withdrawal-capable services as high-risk: isolate and reimage any suspected-compromised laptop and rotate every credential, token and API key it held
- Review service-container access logs and withdrawal-submission logs for transactions not initiated by legitimate workflows
- Revoke or re-authorize addresses, keys and service accounts that can submit withdrawals; require out-of-band approval for large withdrawals
- Share suspect on-chain addresses with stablecoin issuers, chain security councils and blockchain intelligence firms to enable freezes
Workarounds
- Suspend automated withdrawals until withdrawal-path integrity is verified, as Binance did
- Monitor for abnormal EIP-7702 delegations on owned addresses
Longer-term hardening
- Enforce phishing-resistant MFA and hardware-bound credentials for privileged engineers
- Separate developer workstations from production service containers (jump hosts, just-in-time access, no standing credentials)
- Add multi-party approval, velocity limits and anomaly detection on withdrawal submission paths
- Vet and pin developer dependencies and monitor for malicious packages
- Deploy EDR with behavioral detection on developer endpoints
Timeline of Binance security incident
Showing the 20 most recent tracked events.
- Fund freezes begin by about 5:14 p.m. ET; Chainalysis later cites roughly $2.8B frozen.
- Within about 20 minutes, $500M of stablecoins moves to a conversion wallet: $325M is swapped into $285M of ETH and $175M goes to stopover wallets; automated redistribution across thousands of Tron transactions follows (Chainalysis).
- TRM Labs attributes the theft to North Korea's TraderTraitor with high confidence; ZachXBT names Lazarus Group and the Chainalysis CEO concurs. Binance has not attributed.
- At about 23:05 UTC a second wave moves funds on Avalanche and Polygon, bringing TRM's total to about $6.36 billion across ten chains.
- Between about 20:20 and 21:04 UTC Ethereum, Bitcoin, Tron, Solana, Arbitrum, Optimism and Base wallets are drained; most funds leave in about 20 minutes.
- At about 20:05 UTC transfers begin on the XRP Ledger; EIP-7702 delegation of a Binance Ethereum hot wallet follows at about 20:20 UTC using 50 pre-signed authorizations.
- At about 15:59 UTC the exploiter deploys a smart contract (single-source report).
- Bitcoin falls from a 24-hour high of about $81,890 to about $76,301, BNB falls about 5%, and leveraged long positions are liquidated.
- Tether freezes about 1.567 billion USDT and Circle over 800 million USDC tied to the attack; Ripple, World Liberty Financial, the Arbitrum Security Council and Aave also act to freeze assets or lending markets.
- Binance posts a social media alert about a potential security issue and halts trading, deposits and withdrawals; initial frozen assets cited at $2.5 billion.
- Breach begins at roughly 4:30 p.m. ET according to CoinDesk; Binance later describes late-Thursday detection of a potential security issue.
- Bitcoin and Ethereum withdrawals resume while Solana and XRP remain paused; co-CEO Yi He pledges to cover losses via SAFU and company funds.
- Binance follow-up states the investigation identified additional points of breach beyond the compromised laptop.
- At 00:08 UTC the Arbitrum Security Council freezes 8,426 ETH and 74.6M ARB.
- Chainalysis publishes findings assessing TraderTraitor as responsible, citing commingling with Bitget exploit funds; it puts total stolen at $6.4B.
- The Register reports the incident, noting phishing or a supply chain attack on a developer package cannot be ruled out; Binance has not explained initial access.
- Estimated impact is revised to about $6.3 billion with about $3 billion frozen on-chain; Binance and co-founder Yi He pledge to cover all losses from the SAFU fund and company funds.
- Binance preliminary investigation (published around 10:26 per ChainCatcher) points to a compromised DevOps engineer's laptop giving the attacker access to a service container to submit unauthorized withdrawals; no evidence of wallet private key leak.
- Binance says 90% of affected assets have been restored using SAFU, Futures insurance and treasury funds, with about $6.34B set aside; Co-CEO Richard Teng states the incident involved a more complex process than misuse of a single engineer's permissions.
- Binance plans to reopen withdrawals on Sunday 2026-11-01, subject to security checks and final confirmation (planned, not yet confirmed).
Update history for TL-2026-4799
- 2026-10-31 — Binance $6.3B hot wallet theft via compromised DevOps engineer laptop and service container; EIP-7702 delegation used to bypass approval controls (TraderTraitor attribution, unconfirmed by Binance): What changed No severity, exploitability, status or attribution change. Recovery status advances: Binance reports 90% of affected assets covered as of 2026-10-31 and plans to reopen withdrawals on 2026-11-01. New indicators (0) None added.
- 2026-10-31 — Binance Hot Wallet Theft (~$6.3B) Linked to Compromised DevOps Engineer Laptop and EIP-7702 Delegation Abuse; Attributed to TraderTraitor (DPRK): What changed No field escalation: severity CRITICAL, exploitability ACTIVE and status ACTIVE already at maximum. New indicators (4) 1 Ethereum address (0x1510...fe7) tied to Bitget fund commingling, the Binance 14 hot wallet, the sweep() fu
- 2026-10-30 — $6.36 Billion Stolen from Binance Hot Wallets Across Ten Blockchains in Attack Attributed to North Korea's TraderTraitor: What changed No core field escalation. Additive intelligence only: laundering tradecraft (Bitcoin peel chain, Aave and JustLend usage), staging/rehearsal detail, issuer freeze timing and an APT38 alias. New indicators (7) 7 new behavioral/e
- 2026-10-30 — Binance Exploit (Oct 29, 2026): $6.4B Theft via Signed Authorizations Executing Attacker-Deployed Code, Attributed to TraderTraitor (DPRK): What changed No field escalations. Chainalysis cites $6.4B stolen (existing record: ~$6.3B; TRM ~$6.36B) and ~$2.8B frozen (existing: ~$3B). These are estimate variances, not escalations, so the existing values stay. New indicators (4) 3 be
- 2026-10-30 — $6.3 Billion Binance Hot Wallet Theft Attributed to North Korea's TraderTraitor (EIP-7702 Sweeper, Compromised DevOps Laptop): What changed Severity HIGH → CRITICAL (largest crypto theft on record, ~$6.3-6.36B across ten chains, sweeper-based drain). Exploitability and status unchanged (ACTIVE). New indicators (6) TraderTraitor entity, Tornado Cash funding, and beh
Sources cited for Binance security incident
- In the year AI re-wrote the infosec rulebook, it's comforting to know crypto exchanges still have bad security (The Register)
- Live updates: Binance confirms security breach, cryptos fall (CoinDesk)
- Binance Halts Withdrawals, Confirms Hack Of $6.3 Billion (Bitcoin Magazine)
- Binance halts withdrawals after record $6.3 bln hack (Yahoo Finance)
- Binance: Security incident or engineer's... (ChainCatcher)
- Binance reports $6.3 billion crypto breach, potentially the biggest hack in history (Ynetnews)
- Binance halts trading after biggest-ever crypto hack (Axios)
Detection coverage for TL-2026-4799
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4799 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.