Binance hot wallet breach

Exchanges pay out customer withdrawals from hot wallets kept online. These wallets sign thousands of transactions automatically every day. To the chain, a valid signature means the transaction is authorized; the chain cannot see who asked for the signature.

According to Binance’s initial statement, the entry point was a compromised DevOps engineer’s laptop; the company said it found no evidence of a private key leak. Valid signatures were produced on ten different chains, with different key types and signature schemes, within half an hour. That points to an attacker able to make Binance’s signing system sign whatever transaction they wanted.

We verified the attacker addresses and the drain transactions one by one from public blockchain records, read where the money sits today, and compared the attacker addresses with those of earlier major attacks and with sanctions lists. All addresses and transaction IDs are public blockchain data.

Between 20:05 and 23:56 (UTC) on 29 October 2026, 40 transfers went from Binance wallets to the attacker on ten chains. The largest drains happened in the first 20 minutes; the issuers’ first freeze came at 21:01.

Transfers from Binance wallets to the attacker in time order (UTC). We read the “Verified on-chain” rows one by one from public blockchain records (Blockscout, mempool.space, TronGrid, XRPL and Solana nodes); the other rows are totals from published analyses.

The 18,270 BTC publicly described as sent “in one go” appears on-chain as 11 separate transactions in the same block; the largest is 7,636.8 BTC.

Part of the assets in the attacker’s hands were stablecoins their issuers could freeze (USDT, USDC, RLUSD, USD1). In the first hours the attacker raced to convert freezable assets into ones that cannot be frozen.

Of the 2.49 billion USDT stolen on Ethereum and Tron, 1.76 billion (71%) was frozen by Tether. The remaining 729 million USDT was converted to ETH and TRX before the freeze reached it (Bitquery).

Selling at a loss: about 325 million USDT was sold through intent-based contracts for ~122,300 ETH; the price implied by the sale was more than 10% above the market.

Borrowing: one attacker wallet deposited 60 million USDT into Aave V3 and borrowed ~19,760 ETH; Aave then froze 175 V3 reserves on 16 networks and 117 V4 reserves on 4 networks.

Freezes that came too late: 6 of the 11 wallets Tether froze were already empty at the moment of the freeze.

On the Bitcoin side, 18,270.2 BTC was split into 1,000 BTC pieces, with the final consolidation at 20:48.

Balances read from the chain on 2 November 2026. None of the seven large ETH stores has an outgoing transaction.

The 512,621 ETH in the seven stores is more than twice the 200,630 ETH stolen directly from Binance; the difference is ETH bought with stablecoins sold before they were frozen and with other tokens. TRM Labs expects bridges, swap services and over-the-counter brokers to be used in the next stage.

We pulled the full transaction history of 78 Ethereum, 8 Tron and 20 Bitcoin addresses belonging to the attacker, and compared these addresses and all their counterparties with the 51 addresses the FBI published for the Bybit attack, the addresses of the September 2026 Bitget attack, and the 123 Ethereum, 532 Bitcoin and 266 Tron addresses on the OFAC sanctions list.

There is no directly shared address. None of these lists’ addresses appear among the 915 Ethereum and 856 Tron counterparties of the attacker wallets either. The addresses touched by both the Binance and Bitget attackers do not show a direct link:

Chainalysis reports that funds stolen from Binance mixed on-chain with funds from the Bitget attack. We could not independently confirm this link with public data; the connection may lie in labeled databases or deeper than the two hops we examined.

Alongside the chain data we also searched our own infostealer data. Dark Radar data holds 171 stolen account records for the corporate email domains of seven large crypto exchanges. Part of these records are not customer logins but internal systems: at five exchanges, there are corporate-account logins to identity providers, internal code repositories, internal monitoring dashboards, admin panels and cloud single sign-on portals.

On the Binance side, two compromised devices that accessed internal systems with corporate accounts stand out:

Device A’s log was circulating in a Telegram log distribution channel 32 days before the attack. Logs in these channels are sold or distributed in bulk; the access data inside may have reached any buyer.

On Device A, four corporate passwords are also used on personal sites; no known corporate security software is visible on the device. Its access covers almost the entire big data platform (workflow orchestration, event stream management, notebooks) and permission to create users on a monitoring dashboard.

Device B is the closest candidate to the DevOps profile Binance described; however, its credentials date from about a year before the incident.

None of the 35 Binance logs contains a record for a wallet, signing, withdrawal, custody or key management system. None of the attack’s known wallet addresses appears in the logs.

There is no evidence that these devices are linked to the attack; we do not know whether either is the compromised DevOps laptop Binance disclosed. MacSync is a cybercrime tool and has not been attributed to TraderTraitor. The finding shows that access data leaked from engineer devices can circulate in the open for months, even at a major exchange.

A possible path (not proven): an employee’s device is compromised, its access data circulates in criminal channels or is sold, internal systems are reached, and from there the attacker moves on to the signing infrastructure. This analysis found no evidence that this path was used in the 29 October attack. The records that could answer this question conclusively are Binance’s own access logs.

The full technical details of the findings in this section were shared with the Binance security team and the FBI before publication. Internal system names, addresses, log IDs and credentials have not been published.

An attack that starts with a compromised employee computer and ends with billions of dollars in withdrawals has to get past many security controls along the way. Binance’s internal controls are not public; we say a control fell short only at the stages whose outcome is visible on-chain or in Binance’s statement, and for the other stages we describe the control that could have stopped that step. The findings in the first three stages belong to the two devices in Dark Radar data; it has not been proven that these devices were used in the 29 October attack.

Signs visible before the attack began: the preparation was visible on-chain hours earlier. A wallet funded through Tornado Cash deployed EIP-7702 contracts during 29 October, ran tests on two wallets and deployed the sweeper contract at 15:59; the attack began at 20:20. On-chain threat monitoring that watches for wallets funded from a mixer that quickly deploy delegation contracts could have flagged this preparation before the attack. The two devices in Dark Radar data were visible 32 and about 370 days before the incident.

There was no single failure in this incident; successive layers were bypassed in turn. A breach that started at the endpoint and identity layer could have been stopped by the amount and velocity limits of the signing and withdrawal layer. The largest loss came from policy controls at the signing stage and the hot wallet balance not being proportionate to the attacker’s access.

Public blockchain addresses and transactions associated with the attacker. Wallets belonging to Binance are marked “victim”.

According to Binance’s statement, the attack started with an employee’s computer. Compromised access data often enters underground markets before the incident; engineer devices with access to the signing infrastructure should be monitored as closely as the most critical assets.

Compliance teams should add the attacker addresses and the new wallets fed from them (Bitcoin fragments, ETH stores, addresses fed through THORChain and Relay) to deposit screening; the funds are expected to reach exchanges, swap services and OTC desks in the coming days.