Threat intel

Binance's $6.3B hack: TraderTraitor and EIP-7702

By Yaali. October 31, 2026, 6 min read, Threat intel, Phishing.

North Korea's TraderTraitor is blamed for taking about $6.3 billion from Binance hot wallets in 20 minutes. How the signing flow was abused and what to check.

At 20:05 UTC on October 29, 2026, an attacker began moving funds out of Binance hot wallets on ten blockchains. Blockchain analytics firm TRM Labs counts about $6.36 billion taken, most of it in roughly 20 minutes. Binance puts the figure at $6.3 billion and Chainalysis at $6.4 billion. That is about four times the $1.5 billion Bybit theft of February 2025, the previous record.

TRM attributes the attack with high confidence to TraderTraitor, the North Korean unit the FBI blamed for Bybit, and Chainalysis and Elliptic both tie the stolen funds to wallets used in last month's Bitget theft. Binance says its first findings point to a compromised engineer's laptop that gave the attacker access to a service container, from which unauthorized withdrawal transactions were submitted. It has since reported "additional points of breach", says it found no evidence of a private key leak, and will cover all losses. Any organization that runs automated signing for crypto wallets, from exchanges to payment processors and corporate treasuries, should read the mechanics closely.

How it works

A hot wallet is the part of an exchange's custody that a machine can spend from without a human, so customer withdrawals clear in minutes. Its keys sit behind a signing service: other internal systems send it a transaction, policy checks run, and it returns a signature. Whoever can talk to that service with the right permissions can get things signed. Binance's own account, a laptop leading to a container that could submit withdrawals, describes exactly that kind of access.

On Ethereum the attacker went further than a normal withdrawal. EIP-7702, added in Ethereum's Pectra upgrade in May 2025, lets an ordinary account delegate its behaviour to a smart contract by signing an "authorization" that names the contract and the account's current nonce (its transaction counter). The attacker obtained 50 such authorizations signed by the Binance hot wallet, covering 50 consecutive nonces. Because the wallet was processing a steady stream of withdrawals, one of them was bound to match the live nonce. All 50 went in one transaction at 20:20 UTC, each pointing the wallet at a sweeper contract that took orders only from the attacker.

About three and a half minutes later the attacker drained the wallet's full balance: 167,464 ETH and 63 tokens, including 1.615 billion USDT. The delegation was left in place so new deposits could be swept too. On the other chains, including Bitcoin, Tron, Solana, Arbitrum and Base, the attacker simply used ordinary signed transfers. TRM concludes that valid signatures appearing on ten chains within about half an hour point to compromised hot wallet signing infrastructure, not a phished one-off approval. Binance has not published a root cause.

What TraderTraitor does

TraderTraitor works by getting onto the computer of someone close to a signing flow, then changing what gets signed. In the DMM Bitcoin theft of May 2024, which the FBI and Japan's National Police Agency attributed to the group, an operator posing as a recruiter sent an employee of wallet software firm Ginco a malicious Python script on GitHub as a "pre-employment test". The attackers later used stolen session cookies to impersonate staff inside Ginco's communications system and altered a legitimate transaction request, taking 4,502.9 BTC worth $308 million.

For Bybit, investigators from Sygnia and Verichains traced the theft to a Safe{Wallet} developer's macOS workstation compromised through social engineering on February 4, 2025. AWS credentials from that machine let the attackers change JavaScript served from Safe's S3 bucket on February 19 so that only Bybit's cold wallet transactions were rewritten. The malicious code was removed two minutes after the theft.

The Binance operation was staged the same patient way. According to TRM, three small Tornado Cash withdrawals funded the operator wallet on the morning of October 28. Early on October 29 the attacker deployed and tested the attack code on two wallets, rehearsed the final version on a third, and installed it on a Binance hot wallet about four hours later.

Laundering began within the hour. Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC and Circle froze 823 million USDC at 21:04, so the attacker raced to swap stablecoins, which issuers can freeze, into ETH, which they cannot. About 325 million USDT was sold through UniswapX and similar contracts for about 122,300 ETH at more than a 10% discount, and a second wallet put 60 million USDT into Aave to borrow about 19,760 ETH. TRM counted about $2.7 billion frozen by 00:30 UTC on October 30, and Binance later said about $3 billion. The attacker still controls more than 420,000 ETH and 18,270 BTC.

What to check if you sign crypto transactions

These steps apply to anyone running a hot wallet, a treasury wallet or an automated payout service, starting with the exact technique used here.

1. Check your EVM wallets for EIP-7702 delegations. Call eth_getCode on each externally owned account you control; it should return 0x. A result starting with 0xef0100 followed by an address means the account now runs that contract's code. Alert on it in real time, as TRM recommends.
2. Make your signing service refuse EIP-7702 by default. Reject set-code transactions (type 0x04) and authorization requests unless a written policy allows a named contract, and treat any request for several authorizations across a range of nonces as a compromise in progress.
3. Prepare the revocation. A delegation is cleared by signing a new authorization to the zero address. Write that procedure down, pre-approve it and test it on a test wallet, so it is not being invented at 20:25 UTC.
4. Split signing by chain and by wallet tier. One service that can sign on ten chains turns one foothold into ten losses. Separate keys, credentials and network paths per chain, and cap hot wallet balances to near-term withdrawal needs.
5. Harden the people next to the signer. Engineers who can reach signing services, wallet containers or cloud consoles should not run take-home code from recruiters on work machines, should use phishing-resistant hardware keys, and should have short session lifetimes so stolen cookies expire quickly.
6. Look back for signs you were already touched: signing requests outside normal patterns in your signer's audit log, new container exec or deploy events on wallet services, and any type 0x04 transaction naming your addresses in its authorization list.

If you receive crypto from customers or counterparties, screen deposits against the attacker addresses that TRM and Chainalysis have labelled, since the remaining ETH and BTC are expected to move through bridges, swap services and over-the-counter brokers. Keep direct contacts for Tether, Circle and the other stablecoin issuers you hold. Here the first big freeze landed 56 minutes after the theft began and locked 971.1 million USDT.

If your team runs wallet infrastructure or a signing service, our smart contract audits team reviews the contracts and approval logic around custody, and our security operations team can build the on-chain and signer alerting described above. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: TRM Labs, Chainalysis, TechCrunch, CBS News, Al Jazeera, CNBC, BleepingComputer on DMM Bitcoin, BleepingComputer on Bybit.