On the evening of October 29, 2026, Binance, the world’s largest cryptocurrency exchange, suffered the largest cyber theft in its history. According to data from several on-chain analytics firms, including TRM Labs, Chainalysis, and Elliptic, attackers siphoned approximately $6.3 billion to $6.4 billion in assets from Binance’s hot wallets across at least 10 chains in about 20 minutes—a scale far exceeding the $1.5 billion theft from Bybit in 2025.
Binance’s preliminary investigation found that the incident may have started when a DevOps engineer’s laptop was compromised. The hackers then gained access to a service container and submitted unauthorized withdrawal transactions. The company stressed that it has so far found no evidence that wallet private keys were leaked. A subsequent investigation uncovered “additional points of intrusion,” and Binance said this was not the work of a single person acting with one click. Binance has pledged to fully reimburse users for their losses using the SAFU Fund and company funds. Approximately $3 billion in assets have been frozen on-chain.
I. At Least 36 Hours of Preparation Point to a Highly Organized Operation
On-chain analysis by TRM Labs suggests this was not an improvised attack:
• Starting the morning of October 28, the attacker’s operational wallet received small amounts of funds from Tornado Cash three times.
• Early on October 29, the attacker deployed the first version of the attack code and tested it on two wallets.
• Later that day, they rehearsed the final version on a third wallet, then transferred the test funds back.
About four hours after the rehearsal ended, the same code was installed on a Binance hot wallet.
On Ethereum, the attacker used the EIP-7702 delegation mechanism and prepared 50 pre-signed authorizations with consecutive nonces, ensuring that one would successfully take effect. Three minutes later, the large-scale wallet sweep began. This “test, rehearse, then harvest at scale” process closely resembles several previous cases attributed to North Korea-linked groups.
II. Fund Flows and Attribution
TRM Labs and Chainalysis both attributed the incident with “high confidence” to the North Korean elite hacking unit TraderTraitor (an affiliate of the Lazarus Group). The key indicators include the preparation methods, the Tornado Cash funding pattern, and synchronized withdrawals across multiple chains—all consistent with the 2025 Bybit incident, which the FBI attributed to the same group.
More notably, on-chain investigators ZachXBT and Chainalysis found that some of the stolen Binance funds passed through THORChain and then flowed into the same address as funds from the September 2026 Bitget hack, in which approximately $388 million was stolen. The Bitget incident had also previously been attributed to the same organization by multiple parties.
III. Unusual Timing in the Options Market
This is currently the most closely watched aspect of the incident. According to Nicolas Quatravaux, Paradigm’s head of EMEA, in comments to CoinDesk:
• The first large put options block trade took place at 20:38 UTC, about 15 minutes after the first funds flowed out of the Binance wallet, while the news was still not public.
• The trade involved buying 250 BTC put options expiring on October 31, with a strike price of $78,000 (approximately $20 million notional).
• Three minutes later, an identical contract of the same size was traded again, with the buyer paying a premium approximately 35% higher.
• Within 8 hours of the incident, Paradigm executed BTC options block trades with a notional value of approximately $590 million, showing a clear bearish bias.
• Buying was concentrated in the near-the-money range of $74,000–$78,000, and the most active period even occurred before Binance issued a statement.
This large volume of near-term put buying—after funds began flowing out on-chain but before the news had spread widely—could have been a rapid hedge by professional traders who noticed unusually large transfers, or positioning by someone with advance knowledge. There is no public evidence directly proving the latter, but the time window was indeed extremely narrow.
IV. Questions That Remain Unanswered
• How was the engineer’s laptop compromised?
• What are the specific technical details of the “additional intrusion point”?
• What was the full path by which the signing system was abused?
• Who was behind the very early options buying, and where did the funds come from?
• Where did the approximately $2.4 billion that was not frozen (mostly ETH and BTC) go afterward?
Binance has said it will publish a detailed technical report and update its Proof of Reserves once the investigation is complete.
The technical preparation, execution timing, and links between funds from prior cases all point to a highly organized and premeditated operation. The unusual timing in the options market is currently the most glaring aspect—and the hardest to explain away as mere coincidence. It is not necessarily conclusive proof of insider trading, but it is certainly a red flag that warrants further scrutiny.
In cryptocurrency markets, security and transparency of information are always essential. This incident is another reminder that exchanges’ internal access controls, signing infrastructure, and market activity before and after major events all deserve continued attention.
What do you think deserves the most scrutiny in this incident: the technical vulnerability or the coincidence in timing? Share your thoughts in the comments below.
#幣安 #Binance #加密貨幣 #安全事件 #鏈上分析
