News · Security & Hacks
Blockchain intelligence firm TRM Labs links the multi-chain Binance drain to North Korea's TraderTraitor unit, as stablecoin issuers freeze $2.7 billion.
Key point 1 of 3
01
TRM Labs attributed the $6.36B Binance drain on Oct. 29 to North Korea's TraderTraitor hacking unit.
Key point 2 of 3
02
The attacker exploited Binance's hot wallet signing infrastructure and utilized EIP-7702 authorizations on Ethereum.
Key point 3 of 3
03
Stablecoin issuers and Arbitrum froze roughly $2.7B in assets, leaving the attacker with over $2.4B in BTC and ETH.
Context
TraderTraitor, previously identified by the FBI in the February 2025 Bybit breach, utilized pre-signed authorizations and small Tornado Cash funding transactions before…
Why it matters
Binance suspended multi-chain withdrawals following the incident, while centralized stablecoin issuers froze roughly $2.67 billion to mitigate total net losses.
What to watch
A formal root-cause analysis from Binance detailing the hot wallet signing compromise and updates regarding unfreezable funds laundered across decentralized protocols.
Sources
Built from 1 primary source, machine-checked before publication.
Keep reading
Read the full story
AI-generated, source-verified. Sources, citations and live prices on the article page.