--- title: Binance says its $6.3bn hack involved more than a... description: Binance says a compromised DevOps laptop was not the only way attackers breached it in a $6.3bn theft. Blockchain analytics firm TRM Labs attributes the attack... canonical: https://daily.dev/posts/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop-26dgqg0qe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Binance says its $6.3bn hack involved more than a compromised laptop | daily.dev og:description: Binance says a compromised DevOps laptop was not the only way attackers breached it in a $6.3bn theft. Blockchain analytics firm TRM Labs attributes the attack... og:url: https://daily.dev/posts/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop-26dgqg0qe og:image: https://api.daily.dev/og/posts/26DgQG0qE.png og:image:alt: Binance says its $6.3bn hack involved more than a compromised laptop og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Binance says its $6.3bn hack involved more than a compromised laptop **[The Next Web](https://daily.dev/sources/tnw)** · 5 min read · 0 upvotes · 0 comments ## Summary Binance says a compromised DevOps laptop was not the only way attackers breached it in a $6.3bn theft. Blockchain analytics firm TRM Labs attributes the attack to TraderTraitor, a North Korean state hacking unit, and puts the stolen total at $6.36bn. Most funds moved across ten blockchains in about 20 minutes starting 20:05 UTC on 29 October, with attackers using Ethereum's EIP-7702 feature to hand control of a hot wallet to their own code and move 167,464 ETH plus 1.615 billion USDT in one transaction. Tether froze 971.1 million USDT and Circle froze 823 million USDC within the hour. About $3bn has been frozen; attackers still hold roughly $2.4bn that no issuer can freeze. Binance will cover all losses and is on track to resume withdrawals. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers steal $6.3 billion from Binance in 2026? Attackers exploited multiple points of breach beyond an initially suspected compromised DevOps laptop, according to Binance's investigation. On Ethereum, they used the EIP-7702 feature to hand control of a Binance hot wallet to their own code, moving 167,464 ETH and 63 other tokens, including 1.615 billion USDT, in a single transaction. Funds on other chains moved via ordinary signed transfers within the same 20-minute window. _Teams securing exchange wallets can follow emerging attack techniques like EIP-7702 abuse on daily.dev._ ### Who is blamed for the Binance hack and how much was recovered? Blockchain analytics firm TRM Labs attributes the theft to TraderTraitor, a North Korean state hacking unit, with high confidence based on on-chain and off-chain intelligence; Chainalysis reached a similar conclusion. Binance itself has not named a culprit. About $3bn has been frozen by stablecoin issuers and networks, while the attacker still holds roughly $2.4bn in ETH and BTC that cannot be frozen. _Anyone tracking crypto security incidents and attribution can follow this story's developments on daily.dev._ ### What is EIP-7702 and how was it used in an exploit? EIP-7702 is an Ethereum feature that lets an account hand control to its own code, and attackers used it to seize control of a Binance hot wallet, enabling a single transaction that moved 167,464 ETH and 63 other tokens including 1.615 billion USDT. A hot wallet is one an exchange keeps online to process customer withdrawals, making it a high-value target. _Developers evaluating EIP-7702's security implications for wallet design can track this on daily.dev._ --- Tags: [#cyber](https://daily.dev/tags/cyber), [#crypto](https://daily.dev/tags/crypto), [#blockchain](https://daily.dev/tags/blockchain) [View this post on daily.dev](https://daily.dev/posts/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop-26dgqg0qe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Binance says its $6.3bn hack involved more than a compromised laptop","url":"https://daily.dev/posts/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop-26dgqg0qe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop-26dgqg0qe"},"datePublished":"2026-10-30T09:10:23.671Z","dateModified":"2026-10-30T11:09:22.761Z","description":"Binance says a compromised DevOps laptop was not the only way attackers breached it in a $6.3bn theft. Blockchain analytics firm TRM Labs attributes the attack...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4873a114c038ed5566cec63b8da1d128?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4873a114c038ed5566cec63b8da1d128?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop-26dgqg0qe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,crypto,blockchain","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Binance says its $6.3bn hack involved more than a compromised laptop"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/binance-says-its-6-3bn-hack-involved-more-than-a-compromised-laptop-26dgqg0qe#faq","mainEntity":[{"@type":"Question","name":"How did attackers steal $6.3 billion from Binance in 2026?","acceptedAnswer":{"@type":"Answer","text":"Attackers exploited multiple points of breach beyond an initially suspected compromised DevOps laptop, according to Binance's investigation. On Ethereum, they used the EIP-7702 feature to hand control of a Binance hot wallet to their own code, moving 167,464 ETH and 63 other tokens, including 1.615 billion USDT, in a single transaction. Funds on other chains moved via ordinary signed transfers within the same 20-minute window. Teams securing exchange wallets can follow emerging attack techniques like EIP-7702 abuse on daily.dev."}},{"@type":"Question","name":"Who is blamed for the Binance hack and how much was recovered?","acceptedAnswer":{"@type":"Answer","text":"Blockchain analytics firm TRM Labs attributes the theft to TraderTraitor, a North Korean state hacking unit, with high confidence based on on-chain and off-chain intelligence; Chainalysis reached a similar conclusion. Binance itself has not named a culprit. About $3bn has been frozen by stablecoin issuers and networks, while the attacker still holds roughly $2.4bn in ETH and BTC that cannot be frozen. Anyone tracking crypto security incidents and attribution can follow this story's developments on daily.dev."}},{"@type":"Question","name":"What is EIP-7702 and how was it used in an exploit?","acceptedAnswer":{"@type":"Answer","text":"EIP-7702 is an Ethereum feature that lets an account hand control to its own code, and attackers used it to seize control of a Binance hot wallet, enabling a single transaction that moved 167,464 ETH and 63 other tokens including 1.615 billion USDT. A hot wallet is one an exchange keeps online to process customer withdrawals, making it a high-value target. Developers evaluating EIP-7702's security implications for wallet design can track this on daily.dev."}}]} ```