Image: apnews.com
The Story
Binance lost billions through its signing system; the theft is clear, but TraderTraitor’s role is not publicly proven.
A signing system, not a vault door, appears to have released billions from Binance hot wallets. The theft itself is clear; the North Korean attribution rests on tracing firms’ intelligence, while Binance and public officials have not confirmed a direct link. Frozen stablecoins show that crypto’s supposedly borderless money still has chokepoints.
- What is establishedBlockchain records show coordinated transfers totaling roughly $6.3 billion across multiple chains.
- What remains openPublic reporting does not show a government-confirmed or direct on-chain connection to TraderTraitor.
- TRM Labs attributed the attack to TraderTraitor with high confidence, based on on-chain and off-chain intelligence; officials had not confirmed the attribution.
- A separate analysis said no government agency or analytics firm had publicly established attribution, and no on-chain link to known Lazarus wallets had appeared.
- The attack appears to have compromised Binance’s signing infrastructure, while stablecoin issuers froze part of the stolen funds.
Deeper Insight
Binance’s signing system released $6.3 billion in 20 minutes. Decentralized money still waits on centralized trust.
In roughly 20 minutes, a compromised signing system swept $6.3 billion from Binance hot wallets across ten blockchains. Stablecoin issuers froze about half the funds, exposing the choke points beneath crypto’s borderless promise. The blockchain may be public, but the power to move the money is still concentrated.
- What it could changeA successful attack could force crypto exchanges to rethink who can sign transactions and how much they hold online.
- How it touches todayStablecoin freezes show that crypto users already depend on a few private gatekeepers.
- Our futureEvery centralized crypto reserve could become a waiting prize behind a decentralized mask.
- The reported sequence included Tornado Cash funding, rehearsals, prepared code and valid signatures that enabled coordinated sweeps from Binance hot wallets.
- The attack resembles earlier exchange compromises attributed to North Korean-linked groups, including Bybit and Bitget, though similarity is not direct proof.
- The theft exposed a central weakness: large exchanges can hold decentralized assets behind centralized signing systems and operational controls.
Sources · 11
Featured · Analysis · chainalysis.com
The $6.4 Billion Binance Exploit: Tracing the North Korea Link - Chainalysis
The $6.4 Billion Binance Exploit: Tracing the North Korea Link - Chainalysis # The $6.4 Billion Binance Exploit: Tracing the North Korea Link October 30, 2026 | Chainalysis Team Chainalysis investigators assess the $6.4 billion hack of Binance — the largest in the history of crypto, and one of the s
Read sourceAnalysis · tokenpost.com
TRM Assesses Lazarus Group Behind Binance’s $6.3 Billion Theft | TokenPost
TRM Assesses Lazarus Group Behind Binance’s $6.3 Billion Theft | TokenPost # TRM Assesses Lazarus Group Behind Binance’s $6.3 Billion Theft The assessment names TraderTraitor, a Lazarus Group unit, but officials have not confirmed the attribution. Binance said about $3 billion was frozen and it woul
Read sourceAnalysis · newscientist.com
Binance: How did the biggest crypto heist in history just happen? | New Scientist
Binance: How did the biggest crypto heist in history just happen? | New Scientist # How did the biggest crypto heist in history just happen? Billions of dollars' worth of cryptocurrency have been stolen in just a matter of minutes. Researchers are already unpicking what went wrong By Chris Stokel-Wa
Read source