SUMMARY
On Oct 29, 2026, Binance suffered the largest crypto theft in history.
$6.34B was drained from hot wallets between 20:05 - 23:56 UTC.
FBI attributes it to North Korea's TraderTraitor / Lazarus Group.
HOW IT HAPPENED - Multi-stage 6-month campaign:
June 2026 - Initial Access:
Wallet infrastructure engineer downloaded a tampered installer while setting up a popular AI coding tool.
Supply chain compromise.
September 2026 - Second Foothold:
Second wallet engineer contacted via legitimate job platform. Fake interview with CEO of a fictitious company via chat app. Coding "assignment" contained malware.
*Oct 20, 2026 - Privilege Escalation:*
Attackers used compromised machine + an internal AI tool to find container deployment permissions on another wallet engineer's machine and steal credentials.
*Oct 29, 2026 - Execution:*
17:15-19:56 UTC: Deployed malicious container and ran script.
20:05-20:09 UTC: Drained 233.46M XRP from 5 hot wallets in 4 minutes, then ∼970,500 SOL, 44.2M OP, 18,270 BTC.
After that: Abused *Ethereum EIP-7702* to give their own smart contract partial execution rights over a hot wallet without exposing private keys. Last transfer 2,961.9 ETH at 23:56 UTC. Cleared at 00:10 UTC Oct 30.
The attack continued for almost 4 hours _after_ Binance detected large transfers and started freezing withdrawals.
*IMPACT & RECOVERY:*
- *Total affected:* $6.34B
- *Frozen / intercepted:* ∼$2.85B so far. Tether froze ∼$1.6B USDT, Circle $800M+ USDC
- *User funds:* 100% covered by Binance. Emergency reserve + corporate treasury. As of Nov 1, *98% already replenished*, buying remaining illiquid tokens.
- *Withdrawals:* Paused after detection. Phase 1 restored Oct 31 - processed $4.65B withdrawals in 9.5 hours, net outflow $3.64B = only 2.1% of $171B AUM. Phase 2 (Nov 3) restored 9 networks, 51+ tokens.
CONTEXT:
Binance said it had detected and blocked 57 other suspected North Korea-linked threats in 2026 before this one.
Independent cybersecurity firms are now reviewing the incident.
Binance is withholding some technical details to avoid helping future attackers.