started · updated
Binance hack attributed to North Korean group TraderTraitor
The cryptocurrency exchange Binance suffered a massive security breach on October 29, 2026, resulting in the loss of approximately $6.3 billion to $6.36 billion from its hot wallets. The FBI and blockchain intelligence firms, including TRM Labs, have attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group.
The heist was executed through a sophisticated multi-stage campaign involving social engineering. Attackers reportedly impersonated recruiters on job-hunting platforms to conduct fake interviews, eventually persuading an engineer to download a malicious coding assignment. This allowed the hackers to plant malware, compromise an internal AI tool, and reach the exchange’s wallet-signing service.
In one specific instance, hackers allegedly used the EIP-7702 Ethereum upgrade to facilitate the theft, paying only $15 in network fees to trigger a transaction that moved $2.5 billion. Following the breach, stablecoin issuers froze approximately $2.67 billion in tokens. Binance stated it would fully cover the financial impact using its secure asset fund, futures insurance fund, and corporate treasury, noting it has already replenished about 90% to 98% of the affected assets.
The incident has prompted US regulators, including the Federal Reserve and the Office of the Comptroller of the Currency, to contact banks to assess potential security risks. Additionally, rival exchanges like Coinbase, OKX, and Gate have increased transparency regarding their cold storage ratios to reassure customers.
Entities
Arbitrum DAO · Binance · Coinbase · FBI · Federal Reserve · North Korea · Office of the Comptroller of the Currency · TRM Labs · TraderTraitor
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 9 SOURCES] Approximately $6.34 billion in digital assets were affected by the Binance security breach. bizwatchnigeria.ng · news.bitcoin.com · www.pymnts.com · www.csoonline.com · www.altcoinbuzz.io · +1 more
- [● 5 SOURCES] The Federal Reserve and the Office of the Comptroller of the Currency (OCC) contacted US banks on November 2. news.bitcoin.com · www.pymnts.com · www.itnews.com.au
- [○ 1 SOURCE] No successful attacks on US banking systems have been identified in connection with the Binance breach.
- [○ 1 SOURCE] $2.85 billion in digital assets have been frozen or intercepted. bizwatchnigeria.ng
- [● 10 SOURCES] The FBI has identified North Korea as responsible for the attack. bizwatchnigeria.ng · news.bitcoin.com · www.csoonline.com · www.altcoinbuzz.io · diariofinanciero.do · +3 more
- [● 12 SOURCES] The breach reportedly began with a fraudulent job interview targeting an employee. diariofinanciero.do · www.csoonline.com · www.nadanews.com · www.altcoinbuzz.io · cybernoz.com · +3 more
- [● 5 SOURCES] The attack involved unauthorized access to an internal wallet signing service. bizwatchnigeria.ng · diariofinanciero.do · cryptocompass.com
- [● 9 SOURCES] Binance replenished 98 per cent of the affected token assets as of October 31. bizwatchnigeria.ng · diariofinanciero.do · www.altcoinbuzz.io · www.nadanews.com · cybernoz.com · +1 more
- [● 11 SOURCES] The Binance hack involved the use of a fake recruitment process and compromised employee systems. soha.vn · diariofinanciero.do · www.csoonline.com · www.nadanews.com · cybernoz.com · +3 more
- [● 2 SOURCES] Binance is seeking the return of 8,425.997 ETH and 74.56 million ARB from the Arbitrum DAO. www.dcforecasts.com
- [● 3 SOURCES] South Korea's Financial Services Commission is considering increasing the cold wallet requirement from 80% to 99%. newsbit.nl
- [● 8 SOURCES] Coinbase stores more than 99% of customer assets in offline cold wallets. phocapblockchain.net · www.nadanews.com · www.spacemoney.com.br · www.tokenpost.kr