Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.
Source: SecurityWeek · 2026-10-30
Day: October 30, 2026
-
Open-weight AI model GLM-5.3 cheated its way to correct answers
Irregular evaluated Zhipu AI’s open-weight model GLM-5.3 across 13 offensive cyber scenarios using CyScenarioBench, the company’s framework for measuring an LLM’s ability to plan and execute multistage attacks under realistic constraints. The model refused none of the tasks and completed three scenarios at least once each, carrying attacks through dependent stages to reach objectives in simulated networks. Irregular said this was the strongest result it had recorded for an open-weight model. Offensive cyber capabilities Researchers … More
Source: Help Net Security · 2026-10-30
-
Binance links $6.3 billion crypto theft to compromised DevOps laptop
Binance, the world’s largest crypto exchange, has linked the theft of about $6.3 billion in cryptocurrency to a DevOps engineer’s compromised laptop. […]
Source: BleepingComputer · 2026-10-30
-
Federal and State Officials Ramp Up Scrutiny of DraftKings, Other Sports Betting Apps
Connecticut Sen. Richard Blumenthal, one of three federal lawmakers who recently cited ProPublica reporting in a letter asking sports betting companies for more information about their business practices. Tom Williams/CQ-Roll Call, Inc via Getty Images State and federal officials have ramped up scrutiny of online sports betting companies in recent weeks, launching inquiries, demanding information and, in one case, proposing a new rule that would limit when companies like DraftKings can pitch their users to bet more.
The moves — by gaming regulators, government lawyers and federal lawmakers — follow an investigation last month by ProPublica that tested the guardrails DraftKings and other sports betting companies have in place to protect users from spiraling out of control. That system is called responsible gaming, and executives say it’s integral to their companies’ long-term success.
The ProPublica article showed how DraftKings bestowed VIP status on a reporter who deliberately bet like a problem gambler. The report detailed the ways in which the app’s user design and promotions encouraged more betting — even after the reporter opted into responsible gaming tools designed to slow users down. A week earlier, The New York Times reported that DraftKings had used machine learning and artificial intelligence to target promotions to losing bettors.
Those articles were the focus of an Oct. 15 meeting of the Louisiana Gaming Control Board, which, partly in response to the stories, tabled the renewal of DraftKings’ five-year license. Instead, the board granted the company a temporary four-month permit while investigators look into the issues raised in the reports as well as other paperwork concerns.
The board’s chair, Christopher Hebert, said the Times had raised some “very serious questions” and called ProPublica’s reporting “very troubling.”
While news stories “are not findings of regulatory violations,” Hebert said, “as regulators we have a responsibility to examine these matters that could affect the integrity of gaming operations and the protections of our citizens here in Louisiana.”
State health officials say the number of Louisianans believed to have a gambling disorder has risen in recent years amid the surge in popularity of online gambling and prediction market sites. One top official reported this summer that gambling addiction was among the health department’s “top three priorities.”
What Does Your Data Reveal About Sports Betting Apps? Help ProPublica Find Out.
If you’ve bet on sports with FanDuel or DraftKings, you can help ProPublica understand how these apps work. Use our browser extension to download your betting history, then upload your files.
Paul Liberman, who co-founded DraftKings and serves as its president of operations, told the regulators: “We do not use artificial intelligence to target losing gamblers by any means.”
DraftKings previously told ProPublica that it proactively closes the accounts of suspected problem gamblers “all the time” but declined to provide specific figures. Yet when asked by a Louisiana board member for those same specifics, Lori Kalani, DraftKings’ chief responsible gaming officer, said 175 accounts in the state had been shut down this year. She told the board she didn’t know how many total users DraftKings had in the Pelican State.
“We’re not physicians, we’re not clinicians and that’s not our role, but we certainly want to help people enjoy the service, the platform that we’re offering them,” Kalani told the board. “I know that we’re doing our job and that when we see something, we say something and we engage. I just can’t tell you if 175 is the right number. I wish it was zero.”
In a statement, a DraftKings spokesperson said: “As a legal, regulated operator, DraftKings values an open and ongoing dialogue with regulators and regular conversations and check-ins with regulators are normal course of business.”
In response to ProPublica’s original investigation, Kalani said DraftKings’ responsible gaming system — which consists largely of in-app messages about the company’s tools — “worked the way it was supposed to.” She cautioned against “drawing broad conclusions” from one user’s experience.
The day after the Louisiana meeting, regulators in Ohio proposed an amendment to the state’s sports gaming rule that would bar companies like DraftKings from sending direct ads or marketing to bettors for 48 hours after they’d opted into responsible gaming tools or updated their current settings.
The proposed amendment speaks directly to a finding in ProPublica’s reporting: After blowing nearly $4,500 betting on tennis in 24 hours, the reporter used such tools to limit the amount of time and money he could spend on the app. Just 30 minutes later, though, he received the first of four push notifications promoting new betting opportunities. It wasn’t until he opted into a far more restrictive tool, called a “cool-off,” that the notifications temporarily stopped.
Andromeda Morrison, the interim executive director of the Ohio Casino Control Commission, said that though her office had been working on its proposal for some time, ProPublica’s story illuminated the issue. “Hopefully this is something that is fairly easy for the industry to see as a common sense restriction to make sure those consumers are making good choices without those push notifications,” she said.
But Keith Whyte, a former director of the National Council on Problem Gambling who now consults for industry and nonprofit groups, said the proposed amendment could unintentionally disincentivize users from using tools like deposit limits. “I think the implication is that using a responsible gaming tool is a sign of a gambling problem,” he said. The measure faces a long rulemaking process, including more rounds of public hearings and comments.
Sports betting operators are also feeling the heat at the federal level.
Citing ProPublica’s reporting, three Democrats who have long called for industry reforms are now demanding more information from major sports betting and prediction market companies about how the businesses entice their customers.
The letters are signed by Connecticut Sen. Richard Blumenthal, New York Rep. Paul Tonko and North Carolina Rep. Valerie Foushee. They asked the companies to answer a series of questions, including how many customers are enrolled in their VIP programs and how much revenue is generated by them.
“As repeated stories from exploited gamblers and media reports have vividly documented, VIP programs are driving the gambling industry’s most susceptible customers into debt and addiction through rewards tied to waging ever increasing amounts of money,” the lawmakers wrote.
DraftKings conferred VIP status on a ProPublica reporter after he lost close to $6,000 in three weeks on the app by chasing losses with long-shot bets, playing late into the night and firing risky wagers on fast action, like whether a major league baseball player will take a strike, a ball or connect for a hit — betting behavior that experts say are clear red flags of problem gambling.
In a statement, DraftKings said it would “respond accordingly once we have had a chance to review” the letter. Its biggest competitor, FanDuel, which has been trading letters with the lawmakers for months, wrote on Oct. 20 that the company was committed to responsible gaming and said “the VIP program is intended to provide enhanced service and encourage customers who chose to wager to use FanDuel rather than another platform.”
The companies are likely to face further scrutiny.
In New York, investigators for the state’s attorney general have contacted former DraftKings employees about issues raised in the Times’ story, the newspaper reported, citing people familiar with the probe and messages it had reviewed. A spokesperson for the office declined to comment.
That inquiry follows proposals earlier this month by state gaming officials that they say will strengthen New York’s own standards governing the use of artificial intelligence and responsible gaming guidelines.
Regulators in Maine, Massachusetts and Michigan have also said that they’re reviewing some of those same issues.
DraftKings, the spokesperson said, “does not market to customers based on indicators of potential problem gaming.”
Still, there are signs that yet more states may be interested in vetting those claims.
Jennifer Davenport, New Jersey’s attorney general, recently told the RG Journal, a publication that focuses on responsible gaming and industry matters, that “we are monitoring recent press reports alleging certain sports books are ignoring our consumer safeguards and chasing customers who are clearly exhibiting signs of problem betting.”
“Let them be warned, our office stands ready to take action against anyone who violates our gaming regulations and tries taking advantage of New Jerseyans and those who gamble here,” she said.
A spokesperson for Davenport declined to comment.
Source: ProPublica · 2026-10-30
-
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Cybersecurity researchers have disclosed that a trojanized version of Anthropic’s official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems.
The malicious update, version 2.1.313, was distributed under the extension’s legitimate publisher identity, prompting Cursor to temporarily shut
Source: The Hacker News · 2026-10-30
-
Binance Hack: Inside the $6.3B Hot Wallet Theft
The Binance hack drained an estimated $6.3 billion from the exchange’s hot wallets across roughly 10 blockchains on the evening of October 29, 2026. The Binance hack is a hot wallet compromise in which an attacker made Binance’s own withdrawal infrastructure sign and send funds to attacker-controlled addresses, mostly within about 20 minutes.
Binance has confirmed the incident, and the evidence points to a serious, well-resourced operation: staged in advance, executed across chains at once, and built to get unauthorized transactions through the controls meant to stop them. About $3 billion has been blocked through on-chain freezes, and Binance has committed to paying for the rest.
Key Takeaways
- Record loss: Binance estimates the impact of the October 29, 2026 hot wallet theft at around $6.3 billion, about four times the $1.5 billion Bybit theft and the largest crypto heist on record
- Highly prepared operation: The attacker drained about 10 blockchains in roughly 20 minutes, with withdrawals pushed through Binance’s own signing path as if they were legitimate
- Entry point: Binance first linked the breach to a compromised DevOps engineer’s laptop, then said its investigation uncovered additional points of breach in what it calls a complex attack
- Half contained: About $3 billion is frozen on-chain, and Binance has reserved more than $6.34 billion in company funds to cover losses
- Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution
Binance Hack at a Glance
Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, starting around 20:05 UTC Estimated Loss Around $6.3 billion (Binance estimate); independent estimates range from $6.36 billion to $6.4 billion Blockchains Affected About 10, including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon Initial Access (Preliminary) Compromised DevOps engineer laptop plus additional points of breach (Binance, October 30, 2026); full root cause not yet published Private Key Exposure No evidence found (Binance) Frozen So Far About $3 billion on-chain (Binance) Loss Coverage More than $6.34 billion in company funds reserved; about $5 billion already held in the stolen token types Attribution Assessed by blockchain analysts as TraderTraitor (North Korea); not confirmed by Binance or governments Service Status Withdrawals paused while the service is rebuilt and retested; Binance expects them back before Sunday, November 1, 2026; deposits unaffected Binance Hack Timeline
-
October 30, 2026 Binance
Binance reserves $6.34 billion and targets Proof of Reserves by Monday
Binance says it has reserved more than $6.34 billion in company funds, about $5 billion of it already held in the stolen token types, and is buying the rest through market and OTC channels. Co-CEO Richard Teng says the attack was not carried out by one person, the attacker used a self-destruct mechanism to wipe tooling and traces, and a full Proof of Reserves report is planned for Monday.
-
October 30, 2026, 08:47 UTC Binance
Binance finds additional points of breach
Binance says its investigation has uncovered additional points of breach beyond the compromised laptop identified earlier, calling it a complex attack. The outflows stopped when withdrawals were paused, about $3 billion is frozen, and withdrawals remain on track to resume in about 45 hours. Deposits are unaffected.
-
October 30, 2026, 04:17 UTC Status
Withdrawals expected to resume within 48 hours
Binance co-CEO Yi He says withdrawals remain paused while the team improves controls on the withdrawal service and related addresses, and should begin resuming within 48 hours. Deposits are operating normally.
-
October 30, 2026, early morning UTC Attribution
Second firm links the theft to TraderTraitor and a possible Bitget connection emerges
- Attribution: A second blockchain analytics firm says North Korea’s TraderTraitor likely carried out the hack and raises its loss estimate to about $6.4 billion
- Bitget link: An independent investigator finds that funds from the Binance hack and the September 2026 Bitget exploit were mixed at the same address after passing through THORChain
-
October 30, 2026, 02:23 UTC Binance
Binance publishes its Security Incident Update
Binance’s initial investigation suggests a compromised DevOps engineer’s laptop gave the attacker access to a service container that submitted unauthorized withdrawals. Binance says it found no evidence of a wallet private key leak, estimates the impact at around $6.3 billion with about $3 billion frozen on-chain, and will cover all losses from SAFU and company funds.
-
October 30, 2026, 00:30 UTC Attribution
Blockchain analysts attribute the theft to TraderTraitor
Blockchain analysts attribute the theft with high confidence to North Korea’s TraderTraitor and value the stolen assets at $6.36 billion. As of 00:30 UTC, about $2.4 billion remains under attacker control, mostly more than 420,000 ETH and 18,270 BTC. Binance and government agencies have not confirmed the attribution.
-
October 30, 2026, 00:08 UTC Response
Arbitrum Security Council moves funds out of an attacker wallet
The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet.
-
October 29, 2026, 23:05 UTC Attack
Second wave hits Avalanche and Polygon
Binance wallets on Avalanche and Polygon send out funds in a second wave, and smaller sweeps continue until about 23:56 UTC.
-
October 29, 2026, about 22:30 UTC Binance
Binance confirms a security incident and pauses withdrawals
Binance suspends withdrawals on multiple networks as a precaution, says user funds are safe, and warns users not to trust unofficial links or messages about the incident.
-
October 29, 2026, 22:01 to 22:26 UTC Response
Ripple and World Liberty Financial freeze stablecoins
Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet.
-
October 29, 2026, 21:01 to 21:04 UTC Response
Tether and Circle freeze about $1.8 billion
Within about 40 minutes of the main Ethereum sweep, Tether freezes 971.1 million USDT in the attacker’s main receiving wallet and Circle freezes 823 million USDC, in coordination with law enforcement.
-
October 29, 2026, 20:20 to 20:24 UTC Attack
Ethereum hot wallet emptied in under four minutes
- EIP-7702 sweep: One transaction carries 50 authorizations signed by a Binance Ethereum hot wallet, each pointing to an attacker-controlled sweeper contract
- Main drain: About three and a half minutes later, 167,464 ETH and 1.615 billion USDT leave the wallet
- Other chains: 18,270 BTC and 612.7 million USDT on Tron leave Binance in the same window
-
October 29, 2026, 20:05 UTC Attack
Multi-chain drain begins
Five Binance wallets send 233.46 million XRP to a single attacker address. Within roughly 20 minutes, Binance wallets on about 10 blockchains have sent funds out.
-
October 28, 2026 Staging
Attacker prepares an operator wallet
A fresh operator wallet starts receiving small Tornado Cash withdrawals on the morning of October 28, and the attack code is deployed and tested early on October 29.
What Happened in the Binance Hack?
Attackers pushed unauthorized withdrawal transactions through Binance’s hot wallet infrastructure on October 29, 2026, moving an estimated $6.3 billion in crypto to attacker-controlled wallets. The outflows hit about 10 blockchains at once. Binance confirmed a security incident, suspended withdrawals, and revoked authorization for the affected address.
What Did Binance Say in Its Official Statement?
Binance published a Security Incident Update on October 30, 2026, laying out its preliminary findings and response. The key points:
- Initial finding: The initial investigation suggests the incident may involve a compromised DevOps engineer’s laptop, which let the attacker reach a service container and submit unauthorized withdrawal transactions
- Keys: Binance has found no evidence of any wallet private key leak
- Impact: The estimated total impact is around $6.3 billion, with about $3 billion frozen on-chain through blockchain partners
- Coverage: Binance will cover all losses from the SAFU fund and company funds, and says user funds are safe
- Containment: Binance suspended deposits and withdrawals during security checks and revoked the affected address authorization
- Next steps: Law enforcement and blockchain intelligence partners are engaged, and Binance will publish a technical post-mortem and an updated Proof of Reserves
In an October 30 update at 08:47 UTC, Binance said its investigation had identified additional points of breach beyond the laptop, indicating a more complex attack. The exchange confirmed that outflows stopped after withdrawals were suspended, approximately $3 billion remains frozen, and asset recovery for affected users is underway. Binance is also cooperating with law enforcement. In a video statement, co-CEO Richard Teng said the attack “was not carried out by one person.”
How Did Attackers Get Into Binance’s Systems?
Binance first traced the breach to a compromised DevOps engineer’s laptop, which gave the attacker access to a service container that could submit withdrawal transactions. The company adds that the compromised computer was only the first stage, and that its investigation has not assigned responsibility to any individual employee. Its latest update goes further: the investigation has uncovered additional points of breach, which Binance describes as part of a complex attack.
As of October 30, 2026, Binance has not said what the additional points of breach are or published a full root cause.
How Sophisticated Was the Binance Attack?
The on-chain evidence points to a carefully engineered operation. Blockchain tracing shows the attacker funded an operator wallet on October 28, then deployed and tested code early on October 29. When the theft began, Binance wallets on about 10 chains sent funds out within roughly 20 minutes.
The withdrawals carried valid signatures from Binance’s own hot wallet infrastructure, so the approval path that should have blocked them signed them instead. Analysts assess that the attacker gained the ability to make Binance’s signing system approve transactions of its choosing across chains. Binance itself now describes the incident as a complex attack involving more than one point of breach. Co-CEO Richard Teng added that the attacker used a self-destruct mechanism that destroyed tooling and traces along the way, making the investigation harder.
How Much Crypto Was Stolen From Binance?
Binance puts the total impact at around $6.3 billion. Independent tracing values the stolen assets at $6.36 billion at the moment they were taken, and another analytics firm raised its estimate to about $6.4 billion on October 30. The gap reflects different pricing snapshots and timing.
Estimated value of assets taken from Binance by blockchain at the time of theft, with Binance’s impact and freeze estimates. When Did the Binance Hack Happen?
The first unauthorized transfers began around 20:05 UTC on October 29, 2026, when five Binance wallets sent XRP to a single attacker address. Bitcoin, Tron, Solana and Ethereum outflows followed within roughly 20 minutes. A second wave hit Avalanche and Polygon around 23:05 UTC, and smaller sweeps continued until about 23:56 UTC.
Short timeline of Binance’s hack, from attacker staging on October 28 to Binance’s service update on October 30, 2026. What Role Did EIP-7702 Play in the Ethereum Drain?
EIP-7702, an Ethereum feature that lets a regular account delegate its behavior to smart contract code, was used to empty one of Binance’s Ethereum hot wallets. The attacker submitted a single transaction carrying 50 authorizations signed by that wallet, each pointing to an attacker-controlled sweeper contract.
The 50 authorizations covered consecutive nonces, guaranteeing one would be valid at execution time. About three and a half minutes later, the wallet’s full balance, including 167,464 ETH and 1.615 billion USDT, moved to the attacker. EIP-7702 only provided the sweep mechanism; the authorizations still carried the hot wallet’s signature. Binance says the delegation did not pass through its normal approval controls.
Were Binance Private Keys Leaked?
Binance says it has found no evidence of any wallet private key leak. The on-chain pattern is consistent with that: apart from the EIP-7702 sweep, funds on Ethereum and the other chains left through ordinary signed transfers. That pattern fits an attacker who controlled what the signing system approved, rather than one holding stolen keys.
Who Is Behind the Binance Hack?
Blockchain analysts attribute the theft with high confidence to TraderTraitor, a North Korean state-backed cluster often grouped under the Lazarus umbrella. Their assessment cites on-chain and off-chain intelligence and overlaps with earlier thefts, including small Tornado Cash withdrawals for staging and signatures obtained in advance. A second analytics firm says TraderTraitor likely carried it out.
Other investigators are more cautious. One person familiar with crypto investigations told reporters the theft is not yet definitively attributed. As of October 30, 2026, neither Binance nor any government agency has publicly named the attackers.
Is the Binance Hack Linked to the Bitget Hack?
Possibly. An independent on-chain investigator found that funds from the Binance hack and from the September 2026 Bitget exploit were commingled at the same address after passing through THORChain, and said the same actor is likely behind both. Bitget had already said it suspected North Korean attackers in its roughly $387 million loss. Neither exchange has confirmed a shared attacker.
How Much of the Stolen Crypto Has Been Frozen?
Binance reports about $3 billion frozen on-chain as of October 30, 2026, close to half of the estimated loss. Stablecoin issuers did most of the work because they can blacklist addresses holding their tokens, and the first large freezes landed within about 40 minutes of the main Ethereum sweep.
- Tether: Froze more than $1.567 billion in USDT tied to the theft
- Circle: Froze more than $800 million in USDC, in coordination with law enforcement
- Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets
- Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet
Where Is the Rest of the Stolen Money Going?
Roughly $2.4 billion remained under attacker control as of 00:30 UTC on October 30, 2026, mostly more than 420,000 ETH and 18,270 BTC. The bitcoin is moving through a peel chain that splits it into 1,000 BTC and 100 BTC pieces.
The cash-out moved fast, and the attacker accepted heavy losses to stay ahead of the freezes:
- Discounted swaps: About 325 million USDT went to market makers through UniswapX and other intent-based contracts for roughly 122,300 ETH, an implied price near $2,650 per ETH while ether traded around $2,300 to $2,350, a discount of more than 10%
- DeFi borrowing: A second wallet supplied 60 million USDT to Aave and borrowed about 19,760 ETH before Aave froze the affected markets
- Tron routing: 300 million USDT moved to a wallet supplying JustLend, while another 200 million USDT passed through hop wallets to Uniswap, where 30 million was frozen
- Stablecoin dumping: About 48 million RLUSD was sold on decentralized exchanges between 21:42 and 22:01 UTC, until Ripple froze the remaining 40.5 million
Later reporting shows some funds moving through THORChain, a cross-chain swap protocol, an early sign of the cross-chain laundering stage seen after earlier North Korea-linked thefts.
Are Binance User Funds Safe?
Binance says user funds are safe and that it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds. With about $3 billion frozen, that commitment means Binance absorbs the unfrozen remainder itself. The stolen assets came from Binance’s hot wallets, and an updated Proof of Reserves will follow remediation.
More than $6.34 billion in company funds were reserved to cover the losses. About $5 billion of that is already held in the same token types that were stolen, such as USDT, USDC, BTC, ETH and BNB, and Binance is buying the rest through market and OTC channels, which may take longer for low-liquidity tokens. The reserve excludes the roughly $3 billion in frozen assets, which remain subject to recovery. Teng said Binance never uses customer funds, and that most user assets sit in cold wallets and move to a hot wallet only when a user withdraws. A full Proof of Reserves report is targeted for Monday, November 2, 2026.
The SAFU fund was created in 2018 to protect users in extreme cases and reportedly holds about $1 billion in bitcoin, so it cannot absorb a loss of this size alone; Binance says company funds will cover the rest. SAFU last covered a major theft in May 2019, when attackers stole 7,000 BTC from Binance.
Can I Withdraw From Binance Right Now?
Not yet. As of October 30, 2026, Binance withdrawals remain paused while the team rebuilds and retests the withdrawal service, and Binance says it will not switch it back on until it passes rigorous testing. Co-CEO Yi He first said withdrawals should resume within 48 hours, and in a later video statement, co-CEO Richard Teng said users should be able to withdraw before Binance’s Sunday, November 1 deadline, which he put at within 40 hours. Deposits are unaffected.
Service update regarding withdrawal status What Is Binance Doing to Recover From the Hack?
Richard Teng outlined four priorities in his video statement on X:
- Rebuilding withdrawals: The withdrawal service is being rebuilt and will stay off until it passes rigorous testing
- Company-wide security review: Endpoints, cloud, key management and signing are all under review
- Covering the shortfall: Binance is completing its token purchases and will verify holdings through Proof of Reserves
- Tracing funds: Binance is working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen assets
Was Binance.US Affected?
Binance.US was not affected, as live incident coverage of the exchange’s statements noted. Binance.US runs as a separate platform, and the unauthorized withdrawals came from Binance’s global hot wallets. Customers of either platform should treat unsolicited messages that reference the hack with suspicion, since attackers often use major incidents as phishing bait.
How Did the Crypto Market React to the Binance Hack?
Prices fell as news of the theft spread. Bitcoin slid below $77,000, BNB dropped about 7% and ether lost about 5% over 24 hours. Leveraged traders took the brunt, with about $1.55 billion in liquidations over the same period, $1.34 billion of them long positions.
The estimated loss equals roughly 4% of the about $144 billion in assets Binance held before the hack. Market makers Wintermute and GSR disclosed exposure to Binance of less than 20% and less than 5% of net equity, respectively, while Coinbase said it is blocking transfers to compromised wallets.
How Does the Binance Hack Compare to the Bybit Hack?
The Binance hack is about four times the size of the $1.5 billion Bybit theft in February 2025, which the FBI attributed to TraderTraitor. Both began with a compromised developer machine: in Bybit’s case, one belonging to its wallet provider Safe{Wallet}. In both, legitimate signing systems ended up approving the attacker’s transactions.
What Indicators Should Defenders and Exchanges Track?
Binance has not published indicators of compromise, so the indicators below come from public on-chain analysis and explorer labels. Exchanges, bridges and DeFi protocols can screen deposits against these addresses, and wallet operators can watch for the transaction pattern behind the Ethereum drain.
Type Indicator Context Ethereum address (attacker) 0x8532FA14ACAf483729C449b8458aedDb900543D4 Received about 195,460 ETH from the main receiving wallet at 20:38 UTC on October 29, 2026; labeled Binance Hot Wallet Exploiter 8 on Etherscan Ethereum address (attacker, frozen) 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c Main receiving wallet funded by the Binance 14 hot wallet; holds 971.1M USDT and 823M USDC frozen by Tether and Circle Transaction pattern EIP-7702 (type-4) transaction carrying 50 authorizations across consecutive nonces Delegated a Binance Ethereum hot wallet to an attacker-controlled sweeper contract at 20:20 UTC Funding pattern Small Tornado Cash withdrawals into a fresh operator wallet Staging that began on the morning of October 28, 2026 Recommendations for Exchanges, Custodians and Crypto Users
Engineer and DevOps endpoints are now a direct path to hot wallet funds. TraderTraitor has a long record of targeting crypto staff, including DevOps personnel, with social engineering such as fake job offers carrying trojanized applications. The priorities below aim to make sure a single compromised laptop can never reach a service that submits withdrawals.
- Isolate signing paths: Separate hot wallet signing infrastructure by chain and wallet tier so one foothold cannot drain every network
- Harden privileged endpoints: Treat DevOps and engineering laptops as tier-zero assets with strict device posture checks, phishing-resistant MFA and short-lived credentials for production access
- Restrict EIP-7702 use: Configure signers to reject unexpected EIP-7702 authorizations, and alert on batches of authorizations spanning a range of nonces
- Add withdrawal circuit breakers: Enforce velocity limits and anomaly-based holds on hot wallet outflows, especially simultaneous drains across chains
- Screen counterparties: Exchanges, market makers and DeFi protocols should screen deposits and fills against addresses labeled as linked to the Binance theft
- Train for recruiter lures: Brief staff on fake job offers, coding tests and trojanized tools, which North Korean operators favor for initial access
- Watch for scams: Users should rely only on official Binance channels and ignore messages offering refunds, “recovery” services or account verification links
How SOCRadar Supports Crypto Platform Defense
Thefts like this one typically begin before any funds move, with targeted lures, stolen sessions and reconnaissance on staff. SOCRadar helps crypto platforms catch those early signals:
- Cyber Threat Intelligence: Tracks North Korea-linked activity such as TraderTraitor’s tooling and lure themes, so teams can tune detections early
- Dark Web Monitoring: Alerts when employee credentials or session data from infostealer logs surface in underground markets, a common precursor to privileged access
- Brand Protection: Spots fake recovery sites and impersonation domains that appear after high-profile incidents and target worried users
Combined with internal telemetry and strict signing controls, these signals give exchanges and custodians more time to act before an attacker reaches the systems that can move funds.
Source: SOCRadar · 2026-10-30
-
TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.
Source: SecurityWeek · 2026-10-30
-
Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record
About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history. “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the exchange said in a security update published early on October 30. The company found no evidence of a wallet private key leak and plans … More
Source: Help Net Security · 2026-10-30
-
$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
Blockchain analysts link the record crypto theft to North Korean hackers, as Binance probes a possibly compromised engineer laptop.
Source: SecurityWeek · 2026-10-30
-
As Russia’s Cyberwar Evolves, Belarus Steps Forward
The “FrostyNeighbor” advanced persistent threat (APT) launched a destructive attack in Ukraine and is raising concerns about deeper alignment with Russian cyber objectives.
Source: Dark Reading · 2026-10-30
