FBI ties Binance’s $6.3 billion theft to TraderTraitor

Binance says attackers stole about $6.3 billion from its hot wallets on Oct. 29, and the FBI has attributed the record crypto theft to North Korea-linked group TraderTraitor. The FBI asked exchanges and blockchain analytics firms to block transactions tied to the attackers’ addresses, according to the Associated Press report on the FBI attribution. Binance said it would cover the losses with its Secure Asset Fund for Users and corporate funds. Its update put the amount frozen on-chain at about $3 billion.

How did the attacker move funds from Binance’s Ethereum wallet?

On Ethereum, the attacker used the wallet’s valid signatures to delegate its behavior to a sweeper contract, according to blockchain analytics firm Elliptic. EIP-7702, introduced in Ethereum’s Pectra upgrade, lets a regular externally owned account delegate execution to contract code. Elliptic’s analysis says one transaction carried 50 authorizations signed with the key for Binance’s hot wallet called Binance 14. Each authorization covered a different nonce, so one could match the wallet’s transaction count when the transaction landed.

That delegation let the sweeper contract empty Binance 14 minutes later, transferring 167,464 ETH and 63 tokens, including USDT. The delegation remained active, Elliptic says, allowing the attacker to use Binance 14’s owner rights over another Binance wallet to pull USDC. This path matters because the reported Ethereum theft did not require a flaw in Ethereum’s consensus rules: the chain processed signed transactions, while the attacker’s access to Binance’s signing and authorization path enabled them.

Elliptic’s account is based on its analysis of on-chain transactions and Binance’s public updates. Binance initially said a compromised DevOps engineer’s laptop may have given an attacker access to a service container and enabled unauthorized withdrawal transactions. It later reported additional points of breach. The company has said it found no evidence of a private-key leak, but has not publicly detailed those additional access points, according to Elliptic’s technical analysis of the theft.

What happened to assets on the other chains?

On the ten other affected blockchains, Elliptic says Binance wallets sent funds in ordinary signed transactions. The first reported transfers came from five Binance wallets on the XRP Ledger, which sent 233 million XRP to an attacker-controlled address. Hot wallets on other networks were then drained. Elliptic’s total is $6.43 billion across 11 blockchains; Binance put the impact at about $6.3 billion.

The distinction between tokens and native assets shaped recovery. Stablecoin issuers can freeze tokens in addresses they control, and Elliptic verified about $2.85 billion in frozen or seized funds. Binance’s estimate was about $3 billion. Native assets such as ETH and BTC have no token issuer with the same freeze control. The FBI said the attackers were converting stolen assets primarily into ETH and may attempt to move them through decentralized finance and instant swap services.

What does the FBI attribution change?

The FBI’s statement gives investigators a named group to track, while the laundering path remains active. The bureau linked the attack to TraderTraitor, which it also identified as responsible for the 2025 Bybit hack. It asked crypto firms to block transfers connected to the listed addresses. Attribution does not itself reverse transactions: recovery depends on tracing funds and on exchanges, token issuers or networks taking action where they have control.

Sources and documents

• the Associated Press report on the FBI attribution — apnews.com
• Elliptic’s technical analysis of the theft — elliptic.co