Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Binance probe traces $6.36 billion hack to DevOps breach

Part of the TraderTraitor story · since 9 Mar

Developinglatest 9 minutes ago13 articles8 outlets
9 Mar · The Hacker News first5 Jul14 Aug23 SepNowThis article12th of 13
  • Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
  • Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
  • Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
  • Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach. This article, 12th of 13.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.

Binance says its investigation into the October 2026 exploits points to a DevOps compromise followed by abuse of internal signing infrastructure. Officials confirmed that attackers first accessed a DevOps laptop, then breached an internal operational container to issue rogue withdrawal requests. The breach enabled a multichain withdrawal campaign across ten ecosystems, with initial forensic work placing total losses at about $6.3 billion.

TRM Labs’ forensic analysis places the total at $6.36 billion, driven primarily by Ethereum losses of about $3.79 billion and the theft of 18,270 BTC valued near $1.5 billion. The firm’s assessment also notes a secondary wave of activity hours after the initial drain. Binance states deposits remain safe and that restitution is being considered.

ForEthereum withdrawals, investigators found the attackers submitted 50 pre-signed EIP-7702 authorisations aimed at consecutive nonce values to align with ongoing network nonce activity, enabling rapid, batched transfers. The rogue activity reportedly drained 167,464 ETH and $1.6 billion in USDT in minutes. In parallel, the attackers exercised transfers across Tron, Solana, Avalanche and the XRP Ledger, indicating broad signing capabilities across platforms that do not rely on Ethereum delegation.

The investigation notes testing of contracts via Tornado Cash approximately 36 hours before, indicating substantial operational planning. North Korea-linked analysts attribute the intrusion to TraderTraitor, a Lazarus unit, drawing parallels to the February 2025 Bybit breach and underscoring persistent, state-sponsored threats to central exchanges. Binance froze a substantial portion of illicit balances, with Tether, Circle and Ripple actions amounting to several billions and emergency governance moves on Arbitrum.

Restoration estimates foresee phased withdrawal resumption within 48 hours. SAFU and corporate reserves are to cover affected customers.

How the story developed

All 13 articles
Developinglatest 9 minutes ago13 articles8 outlets

13 articles from 8 outlets since 9 Mar. Picked up again on 29 Oct after 2 weeks quiet. This was the 12th report, 235 days after the first.

Now9 Mar2528152425 Sep172641119First reportThe Hacker News · 9 Mar, 16:26This article12th of 13 · day 235Picked up againafter 6 weeks quiet
  • Mon 9 Mar, 16:26 UTC. The Hacker News, first report. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
  • Tue 21 Apr, 19:27 UTC. Security Affairs, its first report on the story. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Thu 23 Apr, 15:01 UTC. The Hacker News. North Korean hackers steal $290m via LayerZero KelpDAO breach.
  • Fri 1 May, 21:31 UTC. Dark Reading, its first report on the story. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks.
  • Mon 7 Sep, 11:26 UTC. Infosecurity, its first report on the story. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Mon 21 Sep, 06:21 UTC. The Hacker News. Jade Sleet Breach Exposes Backdoors and Rising AI Threats.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline, its first report on the story. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests.
  • Mon 12 Oct, 09:11 UTC. SecurityOnline. Fake Terraform AWS provider installs backdoors on developer systems.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach. This article, 12th of 13.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Mon 9 MarDay 01
    1. North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds16:26 · The Hacker News · First report

  2. Quiet for 6 weeks

    Tue 21 AprDay 432
    1. North Korea linked hackers steal $290M from Kelp DAO DeFi10:21 · SecurityWeek · Picked up again
    2. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit19:27 · Security Affairs

  3. Quiet for 2 days

    Thu 23 AprDay 451
    1. North Korean hackers steal $290m via LayerZero KelpDAO breach15:01 · The Hacker News

  4. Quiet for 8 days

    Fri 1 MayDay 531
    1. North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks21:31 · Dark Reading · Picked up again

  5. Quiet for 18 weeks

    Mon 7 SepDay 1821
    1. Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again

  6. Quiet for 2 weeks

    Mon 21 SepDay 1961
    1. Jade Sleet Breach Exposes Backdoors and Rising AI Threats06:21 · The Hacker News · Picked up again

  7. Quiet for 7 days

    Mon 28 SepDay 2031
    1. North Korean Hackers Hide macOS Backdoors in Fake Coding Tests02:30 · SecurityOnline · Picked up again

  8. Quiet for 2 weeks

    Mon 12 OctDay 2171
    1. Fake Terraform AWS provider installs backdoors on developer systems09:11 · SecurityOnline · Picked up again

  9. Quiet for 2 weeks

    Thu 29 OctDay 2341
    1. Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again
  10. Fri 30 OctDay 2353
    1. North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek
    2. Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline · This article, 12th of 13
    3. Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in