29 October 2026 Binance Security Incident: Initial Findings and Response Update 🔐
It started like any other evening on crypto Twitter. Then at exactly 20:05 UTC, the chain started screaming. 🚨 $BTC Within 20 minutes, Binance hot wallets across 8 chains were swept clean. An estimated $6.3 billion - the largest crypto heist in history. What Really Happened? The First 20 Minutes At 20:24 UTC, a hot wallet labeled "Binance 14" executed a single transaction: 167,464 ETH + 1.615B USDT + 63 other tokens - worth ∼$2.5B in one click. 1fad 24 seconds later, "Binance 16" was drained. Then Hot Wallet 34. Then Bitcoin, Solana, Tron, XRP. All to the same receiving address. 1fad Traders watching Arkham saw billions moving in real-time. Was this internal? Was this the end? $BTC How Did They Get In? Not Private Keys. This is what makes this hack terrifying. Binance's postmortem revealed it wasn't a private key leak. It was a multi-month, multi-stage campaign. 0274 1. June: An engineer downloaded a tampered package while setting up an AI coding tool 2. Fake Job Interview: North Korean hackers used a fake interview to trick a Binance DevOps engineer into installing malware on his work laptop 3. October 20: Attackers used that access + an internal AI tool to compromise two more engineers and steal a container deployment token 4. October 29: They deployed the malicious container and triggered the sweep script 0274 On-chain, they abused Ethereum's EIP-7702 - a feature that lets a wallet delegate execution rights via a signature. Trick someone into signing once, and you can install code that sweeps the wallet. 1fad The FBI has attributed the attack with high confidence to TraderTraitor, linked to North Korea's Lazarus Group. 372c The Response: $3 Billion Frozen in Hours This could have been much worse. Within hours, Tether froze $1.57B, Circle froze $800M+, Ripple, Paxos and others joined - totaling ~*$3 billion frozen on-chain*. 372c Binance immediately: - Paused crypto withdrawals (deposits stayed open) - Revoked the EIP-7702 authorization - Activated the SAFU emergency fund (∼$1.2B) + corporate treasury Binance's commitment: "Binance will cover all hacking losses. User funds are safe". 3113 By October 30-31, Binance said it had already replaced 80% then 90% of affected assets and was buying the rest from markets and OTC, with a phased restoration of withdrawals planned. e5d0 Initial Findings Update - What We Know Today: mpact Estimate: ∼$6.3B drained, ∼$3.3B still movable (mostly BTC/ETH) after freezes No private keys leaked according to Binance initial investigation Additional breach points found beyond the first laptop - this was not a simple phishing incident 2517e5d04bcc This was not just a hack. It was a wake-up call for the entire industry. ⚠️ Binance says it blocked 57 suspected North Korea-linked threats this year alone. This one got through. Stay tuned - full technical postmortem is expected in the next 48 hours. This is a developing story. Withdrawals remain phased, always use official Binance channels. #Binance