🚨 $6.36B BINANCE HACK - North Korea Suspected, EIP-7702 Exploited
Binance got absolutely rinsed for ~$6.36 BILLION across 10 chains on Oct 29. Most funds moved in 20 mins. If confirmed, this is the largest crypto heist ever.
THE ATTACK BREAKDOWN:
• EIP-7702 delegation exploit - wallet execution hijacked via malicious smart contract
• 50 pre-signed authorizations prepped in advance
• Sweeper contract deployed to drain balances + catch incoming funds
• Tornado Cash used in prep phase
• Cross-chain moves: $ETH $BTC $SOL $TRX $XRP and more
TRM Labs says attacker compromised Binance's hot wallet signing infra. Binance hasn't dropped the full postmortem yet.
WHO DID IT?
TRM attributes with high confidence to TraderTraitor - North Korean state-backed group. Same crew behind the $1.5B Bybit hack in Feb 2025. FBI already linked that one to NK.
WHERE'S THE MONEY?
• $6.36B total moved
• ~$2.7B frozen (Tether, Circle, Ripple helped)
• Attacker still controls 420K+ $ETH and 18.2K $BTC (~$2.4B)
Binance confirmed ~$6.3B impact, says ~$3B frozen on-chain. They're covering all losses via SAFU + company funds.
BONUS: SOUTH KOREAN BANKS HIT TOO
CrowdStrike uncovered separate AI-assisted attacks on 9 SK banks (Hana, KB Kookmin, Shinhan) between late Sept-early Oct 2026. ~68K people's data exposed.
Suspected Chinese-speaking actor used:
• ARTEX (China-built AI pentesting tool)
• DeepSeek V4.1-Flash, GLM-5.3, Grok 4.6, Claude Code
No confirmed link to Chinese gov. No verified connection between the two attacks.
TAKEAWAY:
State-level actors + AI tools + blockchain exploits = new era of financial warfare. If you're not using hardware wallets and revoking approvals, you're ngmi.
Binance got absolutely rinsed for ~$6.36 BILLION across 10 chains on Oct 29. Most funds moved in 20 mins. If confirmed, this is the largest crypto heist ever.
THE ATTACK BREAKDOWN:
• EIP-7702 delegation exploit - wallet execution hijacked via malicious smart contract
• 50 pre-signed authorizations prepped in advance
• Sweeper contract deployed to drain balances + catch incoming funds
• Tornado Cash used in prep phase
• Cross-chain moves: $ETH $BTC $SOL $TRX $XRP and more
TRM Labs says attacker compromised Binance's hot wallet signing infra. Binance hasn't dropped the full postmortem yet.
WHO DID IT?
TRM attributes with high confidence to TraderTraitor - North Korean state-backed group. Same crew behind the $1.5B Bybit hack in Feb 2025. FBI already linked that one to NK.
WHERE'S THE MONEY?
• $6.36B total moved
• ~$2.7B frozen (Tether, Circle, Ripple helped)
• Attacker still controls 420K+ $ETH and 18.2K $BTC (~$2.4B)
Binance confirmed ~$6.3B impact, says ~$3B frozen on-chain. They're covering all losses via SAFU + company funds.
BONUS: SOUTH KOREAN BANKS HIT TOO
CrowdStrike uncovered separate AI-assisted attacks on 9 SK banks (Hana, KB Kookmin, Shinhan) between late Sept-early Oct 2026. ~68K people's data exposed.
Suspected Chinese-speaking actor used:
• ARTEX (China-built AI pentesting tool)
• DeepSeek V4.1-Flash, GLM-5.3, Grok 4.6, Claude Code
No confirmed link to Chinese gov. No verified connection between the two attacks.
TAKEAWAY:
State-level actors + AI tools + blockchain exploits = new era of financial warfare. If you're not using hardware wallets and revoking approvals, you're ngmi.