Skip to content
OriginalSign in
Image: Dark Reading

Dark ReadingRobert Lemos

Binance Attackers Exploited Weak Controls to Drain $6.34 Billion

Part of the Binance story · since 30 Oct

Developinglatest 1 hour ago28 articles10 outlets
30 Oct · Ars Technica first6 Nov9 NovNowThis article26th of 28
  • Fri 30 Oct, 14:30 UTC. Ars Technica, first report. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs, its first report on the story. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Fri 30 Oct, 23:00 UTC. StepSecurity, its first report on the story. Binance hack highlights risks to developer machines and signing.
  • Sun 1 Nov, 08:30 UTC. The Hacker News, its first report on the story. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. Binance cyberattack: how North Korea launders the stolen $6.4B.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek, its first report on the story. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity, its first report on the story. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 23:30 UTC. Dark Reading, its first report on the story. Binance Hack Shows How One Laptop Led to Billions in Losses.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline, its first report on the story. FBI attributes $6.3 billion Binance heist to North Korea.
  • Tue 3 Nov, 18:00 UTC. The Hacker News. Binance Details How Fake Interviews Led to $6.43 Billion Theft.
  • Tue 3 Nov, 20:30 UTC. Security Affairs. Binance details how fake job interviews enabled a $6.34B hack.
  • Wed 4 Nov, 02:00 UTC. SecurityOnline. FBI links Binance wallet theft to North Korean actors.
  • Wed 4 Nov, 10:00 UTC. Infosecurity. Fake interview campaign leads to major Binance crypto heist.
  • Wed 4 Nov, 10:00 UTC. SecurityWeek. North Korea protests US claims linking hackers to Binance heist.
  • Wed 4 Nov, 11:30 UTC. SecurityWeek. Binance details $6.34 billion theft linked to North Korean group.
  • Wed 4 Nov, 17:00 UTC. Ars Technica. Binance says hackers planned $6.3 billion crypto heist for months.
  • Tue 10 Nov, 10:00 UTC. Infosecurity. Binance investigates ShinyHunters' claims of stolen customer data.
  • Tue 10 Nov, 10:46 UTC. cybersixt. Public Apple iOS sandbox escape lets apps read other apps' data.
  • Tue 10 Nov, 13:30 UTC. The Hacker News. Binance warns iOS sandbox escape could expose crypto wallet keys.
  • Tue 10 Nov, 17:00 UTC. Security Affairs. Public iOS sandbox exploit can expose data across apps.
  • Wed 11 Nov, 12:00 UTC. SOCRadar, its first report on the story. FBI attributes $6.3 billion Binance theft to North Korea. Cites a CVE in CISA KEV.
  • Fri 13 Nov, 03:00 UTC. SecurityWeek. FBI Seizes $1.2 Billion in Crypto Stolen From Binance.
  • Fri 13 Nov, 03:31 UTC. SecurityOnline. DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B.
  • Fri 13 Nov, 12:30 UTC. SOCRadar. FBI disrupts North Korean fake video call crypto scam.
  • Fri 13 Nov, 13:30 UTC. Dark Reading. Binance Attackers Exploited Weak Controls to Drain $6.34 Billion. This article, 26th of 28.
  • Fri 13 Nov, 18:00 UTC. StepSecurity. JFrog exposes fake interview campaign targeting developer machines.
  • Fri 13 Nov, 23:00 UTC. Security Affairs. DOJ disrupts North Korean crypto theft and seizes $1.2 billion.

On 29 October 2026, cyber thieves moved around $6.34 billion in various cryptocurrencies from at least 11 Binance wallets to attacker-controlled addresses. The attackers exploited a feature of Ethereum smart accounts known as EIP-7702, enabling a so‑called “sweeper” that transferred assets by installing malicious code and creating a pre‑signed, on‑chain authorization.

Binance’s internal security systems issued alerts within minutes, but the on‑chain authorisations persisted for about four hours, allowing further funds to be siphoned before controls could fully stop the activity. An analysis by BlockAid tracked the ultimately compromised wallet as left with a single ETH coin, while large transactions from other wallets to the same address triggered additional internal alerts at Binance.

BlockAid notes that an EIP-7702 authorization is a standing delegation that can move funds once on-chain until revoked, with no inherent withdrawal restrictions.

The post‑mortem and external analyses emphasise that the breach stemmed from weak developer and governance controls, including compromised developer systems used to sign authorisations. Binance’s investigation points to at least 50 presigned authorisations created during the attack, facilitated by developer and vendor compromises, and notes that the authorization could bypass normal withdrawal controls.

Experts from Sygnia and TRM Labs advocate enhanced protections across identity, transaction authorization, and real‑time monitoring, including fast kill switches and predetermined containment steps. The report highlights that, despite some monitoring, Binance lacked a comprehensive set of safeguards to revoke on‑chain authorisations rapidly, and that the incident underlines the need for simultaneous on‑ and off‑chain controls and rehearsed incident response. The FBI and other authorities have linked related activity to the TraderTraitor group.

How the story developed

All 28 articles
Developinglatest 1 hour ago28 articles10 outlets

28 articles from 10 outlets since 30 Oct. Still developing; the latest report was 1 hour ago. This was the 26th report, 14 days after the first.

Now30 Oct234111213First reportArs Technica · 30 Oct, 14:30This article26th of 28 · day 14Exploited CVESOCRadar · 11 Nov
  • Fri 30 Oct, 14:30 UTC. Ars Technica, first report. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs, its first report on the story. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Fri 30 Oct, 23:00 UTC. StepSecurity, its first report on the story. Binance hack highlights risks to developer machines and signing.
  • Sun 1 Nov, 08:30 UTC. The Hacker News, its first report on the story. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. Binance cyberattack: how North Korea launders the stolen $6.4B.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek, its first report on the story. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity, its first report on the story. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 23:30 UTC. Dark Reading, its first report on the story. Binance Hack Shows How One Laptop Led to Billions in Losses.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline, its first report on the story. FBI attributes $6.3 billion Binance heist to North Korea.
  • Tue 3 Nov, 18:00 UTC. The Hacker News. Binance Details How Fake Interviews Led to $6.43 Billion Theft.
  • Tue 3 Nov, 20:30 UTC. Security Affairs. Binance details how fake job interviews enabled a $6.34B hack.
  • Wed 4 Nov, 02:00 UTC. SecurityOnline. FBI links Binance wallet theft to North Korean actors.
  • Wed 4 Nov, 10:00 UTC. Infosecurity. Fake interview campaign leads to major Binance crypto heist.
  • Wed 4 Nov, 10:00 UTC. SecurityWeek. North Korea protests US claims linking hackers to Binance heist.
  • Wed 4 Nov, 11:30 UTC. SecurityWeek. Binance details $6.34 billion theft linked to North Korean group.
  • Wed 4 Nov, 17:00 UTC. Ars Technica. Binance says hackers planned $6.3 billion crypto heist for months.
  • Tue 10 Nov, 10:00 UTC. Infosecurity. Binance investigates ShinyHunters' claims of stolen customer data.
  • Tue 10 Nov, 10:46 UTC. cybersixt. Public Apple iOS sandbox escape lets apps read other apps' data.
  • Tue 10 Nov, 13:30 UTC. The Hacker News. Binance warns iOS sandbox escape could expose crypto wallet keys.
  • Tue 10 Nov, 17:00 UTC. Security Affairs. Public iOS sandbox exploit can expose data across apps.
  • Wed 11 Nov, 12:00 UTC. SOCRadar, its first report on the story. FBI attributes $6.3 billion Binance theft to North Korea. Cites a CVE in CISA KEV.
  • Fri 13 Nov, 03:00 UTC. SecurityWeek. FBI Seizes $1.2 Billion in Crypto Stolen From Binance.
  • Fri 13 Nov, 03:31 UTC. SecurityOnline. DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B.
  • Fri 13 Nov, 12:30 UTC. SOCRadar. FBI disrupts North Korean fake video call crypto scam.
  • Fri 13 Nov, 13:30 UTC. Dark Reading. Binance Attackers Exploited Weak Controls to Drain $6.34 Billion. This article, 26th of 28.
  • Fri 13 Nov, 18:00 UTC. StepSecurity. JFrog exposes fake interview campaign targeting developer machines.
  • Fri 13 Nov, 23:00 UTC. Security Affairs. DOJ disrupts North Korean crypto theft and seizes $1.2 billion.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 28 articles as a list
  1. Fri 30 OctDay 03
    1. TRM Labs links record $6.3 billion Binance heist to North Korea14:30 · Ars Technica · First report
    2. TRM Labs attributes $6.3 billion Binance theft to North Korea19:30 · Security Affairs
    3. Binance hack highlights risks to developer machines and signing23:00 · StepSecurity
  2. Sun 1 NovDay 23
    1. FBI blames North Korea group for $6.43 billion Binance heist08:30 · The Hacker News
    2. Binance cyberattack: how North Korea launders the stolen $6.4B09:55 · cybersixt
    3. FBI blames North Korea linked group for Binance theft20:30 · Security Affairs
  3. Mon 2 NovDay 33
    1. FBI Links North Korea’s TraderTraitor to Binance Heist09:30 · SecurityWeek
    2. FBI links Binance crypto breach to North Korea’s TraderTraitor11:00 · Infosecurity
    3. Binance Hack Shows How One Laptop Led to Billions in Losses23:30 · Dark Reading
  4. Tue 3 NovDay 43
    1. FBI attributes $6.3 billion Binance heist to North Korea10:30 · SecurityOnline
    2. Binance Details How Fake Interviews Led to $6.43 Billion Theft18:00 · The Hacker News
    3. Binance details how fake job interviews enabled a $6.34B hack20:30 · Security Affairs
  5. Wed 4 NovDay 55
    1. FBI links Binance wallet theft to North Korean actors02:00 · SecurityOnline
    2. Fake interview campaign leads to major Binance crypto heist10:00 · Infosecurity
    3. North Korea protests US claims linking hackers to Binance heist10:00 · SecurityWeek
    Show 2 more from 4 Nov
    1. Binance details $6.34 billion theft linked to North Korean group11:30 · SecurityWeek
    2. Binance says hackers planned $6.3 billion crypto heist for months17:00 · Ars Technica

  6. Quiet for 6 days

    Tue 10 NovDay 114
    1. Binance investigates ShinyHunters' claims of stolen customer data10:00 · Infosecurity · Picked up again
    2. Public Apple iOS sandbox escape lets apps read other apps' data10:46 · cybersixt
    3. Binance warns iOS sandbox escape could expose crypto wallet keys13:30 · The Hacker News
    4. Public iOS sandbox exploit can expose data across apps17:00 · Security Affairs
  7. Wed 11 NovDay 121
    1. FBI attributes $6.3 billion Binance theft to North Korea12:00 · SOCRadar · Exploited CVE · Known exploited CVE

  8. Quiet for 2 days

    Fri 13 NovDay 146
    1. FBI Seizes $1.2 Billion in Crypto Stolen From Binance03:00 · SecurityWeek
    2. DOJ Disrupts North Korean Crypto Theft Schemes and Seizes $1.2B03:31 · SecurityOnline
    3. Binance Attackers Exploited Weak Controls to Drain $6.34 Billion13:30 · Dark Reading · This article, 26th of 28
    Show 3 more from 13 Nov
    1. FBI disrupts North Korean fake video call crypto scam12:30 · SOCRadar
    2. JFrog exposes fake interview campaign targeting developer machines18:00 · StepSecurity
    3. DOJ disrupts North Korean crypto theft and seizes $1.2 billion23:00 · Security Affairs

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in