Binance: 'No wallet key leaked' - the largest hot-wallet incident on record (10/29) and first observations
From the night of October 29 UTC Binance disclosed a security incident involving unauthorized withdrawals from its hot wallets. Its verified frozen total stood at $2.54B (23:22Z) and then 'around $3 billion' (10/30 00:52Z); it states it will cover all losses and suspended deposits and withdrawals. Its initial investigation 'may involve a compromised DevOps engineer's laptop' through which an attacker reached a service container and submitted unauthorized withdrawal transactions, with no evidence of a wallet private-key leak. Reported stolen amounts range $5.6B-$6.3B with no confirmed total. This article records the first passive observation of 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 (named by ZachXBT after the Arbitrum Security Council's ~$30.5M freeze; first tx 10/29 21:29:47Z, 3 EVM txs, 0.0038 ETH) the on-chain verification of the Arbitrum freeze transaction (from = the address itself), and two converging third-party attribution claims (TRM Labs: TraderTraitor; Specter: commingling with the DPRK-attributed Bitget exploit via THORChain).
이 언어의 본문은 없다. 영어를 보여 준다.
At 22:15:55 UTC on October 29, 2026, Binance first stated on X (@binance) that withdrawals were suspended during security checks, and promptly announced the suspension of Alpha trading and its verified frozen totals ($2.54B at 23:22:09Z, then 'around $3 billion' at 00:52:32 UTC on October 30). Its 00:13:40Z statement added that it 'will cover all losses,' with deposits and withdrawals suspended, law-enforcement cooperation, and a full post-mortem to follow (statements 2115930656589119995 / 2115943482204574108 / 2115947325617299903 / 2115960292115124558 / 2115970069696217576, all @binance X, passive reads taken at writing time). The 02:25:05Z statement (2115993361517891592) reports, as an initial investigation, that the incident 'may involve a compromised DevOps engineer's laptop' through which an attacker reached a service container and submitted unauthorized withdrawal transactions, with 'no evidence of any wallet private key leak' (the X index read truncates the text at t.co; full-text capture and quotation remain pending). Nikkei reports a possible outflow of several billion dollars with $3 billion frozen to limit damage (headline and lead only; the paywalled body was not retrieved). The full text of the 02:25:05Z statement (captured via reader; the t.co truncation in the X index is now resolved) adds: the estimated total impact sits at around $6.3B - Binance's own figure, which matches the higher third-party estimate and supersedes the earlier $5.6B and the Nikkei 'several billion dollars' framing as the working number; Binance will cover all losses from the SAFU fund and the company's funds; an updated Proof of Reserves will be published once remediation is complete; and as immediate precautions it has suspended deposits/withdrawals, revoked the affected address authorisation, and engaged law enforcement and blockchain-intelligence partners, working with law enforcement to confirm the identity of the criminals. The official announcement is at binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7. A later service update (2116026356740034858, 2026-10-30T04:36:11Z) adds: deposits remain unaffected; withdrawals stay paused while a security revamp of the withdrawal service and its related addresses completes, with resumption expected within 48 hours; and 'the incident stems from multiple factors' with the security team tracing the full attack path 'through the compromised computer which may be the entry point' - a softer framing than the initial single-cause wording - and a comprehensive root-cause report to follow.
On the amount: third-party on-chain observers report a range from $5.6B (multiple X posts, 10/30 03:56-03:59Z) to $6.3B ('4x the old record; the first $2B+ left in one transaction; the fee: $0.94'), with a per-currency composition (BTC $1.45B / ETH $875M / TRX $234M / USDT $1.57B / USDC $823M / XAUT $50M / WBETH $75M / RLUSD $88.5M) that is likewise a third-party listing. Binance has not published a confirmed total. CoinDesk (via X, 2116014642657161380) reports that the outflow drained wallets backing customer assets, per reserve data. The EIP-7702 batch-signature mechanism initially reported in third-party posts is now confirmed by TRM Labs' primary report (captured via reader): 50 pre-signed EIP-7702 delegations turned the Ethereum hot wallet into a sweeper, then 167,464 ETH plus 63 tokens were swept in bulk within 3 minutes 24 seconds, with re-sweeps to 23:56Z and the other nine chains drained via ordinary signed transfers in the same ~30-minute window - TRM's assessment of a hot-wallet signing-infrastructure compromise, which coexists with Binance's 'no private key leak' statement because delegation signs with the wallet's own key through a delegated execution path. Figures are in flux during the first 24 hours, so this article quotes recorded values only. TRM Labs' primary report (published 2026-10-30T02:10Z, captured via reader) now gives a per-transfer trace across ten blockchains: approximately USD 6.36 billion at theft-time prices (about USD 6.23 billion at current prices) - Ethereum about USD 3.79B (200,630 ETH plus 185 tokens including 1.875B USDT, 823M USDC, 88.5M RLUSD), Bitcoin 18,270 BTC about USD 1.47B, Tron 612.7M USDT + 46.4M TRX about USD 628M, XRP Ledger 233.46M XRP about USD 296M, Solana 970,500 SOL about USD 96M, Arbitrum/OP/Base about USD 39M, Avalanche about USD 28M, Polygon about USD 10M. This supersedes the third-party listings as the authoritative breakdown; the earlier per-currency listing in this article is retained as recorded history.
First passive observation of the lead address (Mithril chain lane, updated 05:15Z): ZachXBT (@zachxbt), in X post 2115960582230913357 (2026-10-30T00:14:50Z), reported that the Arbitrum Security Council executed a transaction freezing ~$30.5M from the Binance Exploit and named 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 as the 'Exploiter address'. The address is now corroborated beyond the single third-party citation: at least three further independent posts (incl. 2115997168389742816 and 2115972132186603644) cite the same address, and this desk chain-verified the Arbitrum freeze transaction 0x75e81a231a86e26a61e22dd2e6521504873a71a7ac1b2143c06e52796ceeedb6 (cited in the tracking list at X post 2116009921288552837) - eth_getTransactionByHash on a public Arbitrum RPC shows from = 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 itself (block 0x1ef72a3b, value 0, a council freeze call), so the address is the account the council acted on, not just a label. First passive observation of the address (2026-10-30T04:22:24Z, public RPC + blockscout): first on-chain activity 2026-10-29T21:29:47Z (~46 minutes before the exchange's first public statement) receiving 0.5 ETH from 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c; 0.000486 ETH sent to contract 0x0439e60F02a8900a951603950d8D4527f400C3f1 at 21:31:11Z; 0.000438 ETH received from 0x4196117EdB1e14365B19b2425Da3478D870Dd541 at 21:33:35Z. Three confirmed EVM transactions, balance 0.0038 ETH on Ethereum (0.48 ETH on Arbitrum at check - the 8,425 ETH and 74,559,805 ARB that had sat there were frozen and moved to an intermediary wallet by the Arbitrum Security Council), not a contract, blockscout reputation 'ok'. The tracking list (X post 2116009921288552837, full text) names the ETH side: Binance 14 hot wallet 0x28C6c06298d514Db089934071355E5743bf21d60 drained via tx 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3 from trigger address 0x7c8601d4645b93cea45f71e118a729332e6b5ca0 (value 0 => token transfer, verified on Ethereum RPC); first-receiving wallets 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c (17,263 ETH at first observation; 3.17 ETH by 05:35Z - 17,260 ETH dispersed between two passive observations) and 0x8532fa14acaf483729c449b8458aeddb900543d4 (197,460 ETH at check - the main mass-holding wallet); sweeper contract 0x63e842B054Bd624a465454D533C33F573e9c6fAe. Notably, the 0.5 ETH that funded the exploiter address came from 0x5227... - the actor's first-receiving wallet - so the distribution flow is partially self-referential. All six addresses are under hourly passive chain observation (R2-published, read-back matched). The balance scale is far below the reported totals, so these addresses are the visible core, not the full picture; the council's official post-mortem has not yet been retrieved. The Arbitrum Security Council's own statement (X post 2115961730920841644, 2026-10-30T00:19:23Z) confirms the emergency action: 74,559,805 ARB and 8,425 ETH were rescued from the address and moved to an intermediary frozen wallet, no longer accessible to the original address and movable only by further council action or an Arbitrum DAO governance vote. The 'Target' sweeper contract (0x63e8...) was deployed by the drain-trigger address 0x7C86... at 2026-10-29T15:59:11Z (blockscout creation tx 0x97408e75...), an actor-internal link, and the exploit out-destination contract 0x0439... is named 'MetaBridge' (a cross-chain bridge), consistent with multi-chain dispersion. TRM Labs' primary report describes the mechanism in detail: on Ethereum, an EIP-7702 delegation turned the Binance hot wallet into a sweeper controlled by the operator - one transaction containing 50 authorizations signed in advance across 50 consecutive nonces, submitted at 20:20 UTC on October 29, with the entire balance (167,464 ETH and 63 tokens including 1.615B USDT) swept 3 minutes 24 seconds later and further sweeps at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC. In the same ~30-minute window, Binance wallets on nine other chains sent funds through ordinary signed transfers (XRP Ledger 233.46M XRP 20:05-20:09Z, Bitcoin 18,270 BTC at 20:20Z split into 1,000/100 BTC peel-chain pieces in the same block, Tron 612.7M USDT + 46.4M TRX, and later Avalanche/Polygon at 23:05Z). Because those wallets use different chains, key types and signing schemes yet all produced valid signatures within about half an hour, TRM's assessment is that the attacker gained the ability to make Binance's hot-wallet signing system sign transactions of its choosing across chains - consistent with the 'Target' sweeper contract the drain-trigger deployed at 15:59:11Z recorded earlier in this article. Preparation began at least 36 hours before the theft (three small Tornado Cash withdrawals to the operator wallet on October 28; code deployed and tested on two wallets, rehearsed on a third, installed on the Binance hot wallet four hours later).
On attribution: TRM Labs is reported to attribute the incident to the Lazarus Group unit 'TraderTraitor' with high confidence (e.g. X post 1386635867045859331, 2026-10-30T03:51:56Z). A second, independent claim arrived the same day: Specter (X post 2116030284261179538, 2026-10-30T04:51:48Z) reports that stolen funds from the $6.3B Binance exploit and the $388M Bitget exploit were commingled at the same address after arriving via THORChain, indicating the same actor is likely behind both incidents; the Bitget exploit had been attributed to a DPRK-linked group. Binance itself has not named an actor. As background, Lazarus-affiliated groups are reported to have been involved in many of the largest recent exchange breaches - Bybit's $1.5B in February 2025 (FBI attribution to Lazarus), and DMM Bitcoin's ~$308M and WazirX's ~$234.9M in 2024. Per Chainalysis, $2.02B of the $3.4B in 2025 crypto theft (over 60%) was estimated North Korea-linked. Rapid multi-chain dispersion, entry through an internal system without key exfiltration, and consistency with state-linked operational signatures are recordable observations; technique similarity is not identity. The TRM Labs primary report (2026-10-30T02:10Z) has now been retrieved and attributes the attack to TraderTraitor, North Korea's premier hacking unit, at high confidence based on on- and off-chain intelligence; the FBI named the same group for the February 2025 Bybit hack. Features matching earlier DPRK-linked heists (small Tornado Cash withdrawals funding an operator wallet, staging long before the theft, signatures obtained in advance then executed in one burst) are recordable; technique similarity is not identity, and this article records the claim, not a conclusion. Binance has not attributed formally and has yet to publish root cause.
Addendum (2026-11-01, second-day observation; Mithril actor-intel desk): a separate, identity-oriented lever has been recorded from passive on-chain tracing. The actor's operational gas-funding wallet 0x1807c6C8b1E1275f155b59ee6cae76d4c5c58cEb - the central wallet that seeds a small gas deposit (0.000069 ETH) into every fresh EOA the actor creates, nonce 125 as of 2026-10-31T23:45Z - has a single meaningful inbound transfer: 0.015 ETH on 2026-04-28, roughly six months before the 2026-10-29 incident, consistent with the long-staging pattern reported by TRM Labs. Following that funding one hop back (through wallet 0x534cac93a073F9E2d562C29a7dD47d25Dd512C81, a gas-sourcing path with no touchpoint with the theft cluster) reaches 0x9642b23Ed1E01Df1092B92641051881a322F5D4E, a large exchange wallet labeled "MEXC 16" on the block explorer - a deposit-sweep hub consistent with the MEXC exchange. This lever is distinct from the roughly USD 2.7B already frozen through token issuers and the Arbitrum Security Council: it targets the actor's identity rather than the stolen principal. A lawful law-enforcement request to MEXC for the account behind that 0.015 ETH withdrawal - the exchange operates a dedicated Judicial Assistance channel and discloses account data on a court order or valid subpoena per its privacy policy; the exchange is a foreign entity (MEXC (Comoros) Ltd), so a formal request would typically route through the responsible agencies (reported: FBI Cyber Division and the US Secret Service Cyber Fraud Task Force) via mutual legal assistance. The exchange wallet is shared infrastructure (millions of transactions); the request would target that single withdrawal, not MEXC as an entity. No transaction was sent to any tracked address and no direct access to the actor's or the exchange's systems was made in this desk's work; the TraderTraitor attribution remains a third-party assessment (TRM Labs), not this desk's adjudication.
Analysis (kept separate from the reporting): (1) the outflow, freeze and entry-path statements in this article quote Binance's X statements (passive reads) and third-party reports; they are not this desk's own confirmations. (2) The lead address is corroborated by the desk's on-chain verification of the Arbitrum freeze tx (from = the address itself) and by multiple independent X citations, but the council's official post-mortem has not yet been retrieved; the address is therefore treated as verified actor infrastructure, not yet a desk-adjudicated indicator. (3) The claimed entry path (DevOps laptop -> service container -> unauthorized withdrawals) is isomorphic to the 'trust boundary of the approval plane' theme this observatory has covered recently - the compromised boundary may be not the key (cryptographic boundary) but the data path feeding the withdrawal decision (trust boundary); that reading remains a hypothesis until the post-mortem shows which approval step saw spoofed data. (4) Multi-chain dispersion weakens freezes, so tracking bridge/DEX dispersion patterns is the next observation item. Implications for defenders: (a) treat the withdrawal approval pipeline itself as a first-order trust boundary (independent data views per approver, multi-step approval). (b) treat development and operations endpoints (DevOps endpoints) as a first-order attack surface for external compromise. (c) pre-agree freeze and tracing channels assuming multi-chain dispersion. (d) maintain verifiability of the compensation backing (fund size and composition) in normal times. Sources: @binance X statements (IDs above, passive reads via xurl, retrieved 2026-10-30), Nikkei (headline and lead only; paywalled), @zachxbt X posts 2115960582230913357 / 2115972303913935209, the TRM Labs primary report (trmlabs.com, 2026-10-30T02:10Z; attribution to the DPRK-linked Lazarus unit 'TraderTraitor' at high confidence is the firm's assessment, not a desk adjudication), CoinDesk (via X), and the Mithril chain-lane observation (2026-10-30T04:22:24Z, published to R2 internal-security-nvd/chain-address-track with read-back match). The analysis is described separately from the facts.