The FBI Blames North Korea for the $6.3 Billion Binance Theft, and the Chain Shows a Binance Hot Wallet Stayed Delegated to the Attacker’s Contract for 3 Hours 49 Minutes

The FBI said on October 31 that North Korea was responsible for the theft of “more than $6 billion USD in virtual assets” from Binance “on or about October 29, 2026,” and named the activity “TraderTraitor.” Binance began reopening withdrawals in phases on November 1 and says it has now covered about 95 percent of the impacted amount. What neither the FBI nor Binance has published is how the attackers got in.

The notice is a short attribution, a request that other companies block the listed addresses, and 628 addresses. Binance’s own account has widened since its first detailed statement pointed at a DevOps engineer’s laptop and it later reported “additional points of breach.” TRM Labs, Chainalysis and Elliptic have filled the gap with on-chain analysis, and two of them argue that Binance’s own signing systems produced the signatures the thieves needed.

We checked the public chain ourselves instead of relying on those summaries. Three results stand out:

• The delegation. In Ethereum block 26,300,753 (20:20:59 UTC on October 29), one transaction carrying 50 EIP-7702 authorizations pointed the Binance hot wallet that Elliptic calls Binance 14 at a contract the attacker chose. Three minutes and 24 seconds later the wallet was emptied of about 167,464 ETH and 1.615 billion USDT.
• The duration. That delegation was not cleared until block 26,301,896 (00:10:35 UTC on October 30), 3 hours 49 minutes 36 seconds after it went in and 2 hours 41 minutes after the earliest Binance post about the incident that we found.
• The coins. At 19:32 UTC on November 1 the 19 Bitcoin addresses on the FBI’s list still held 18,270.20 BTC, and its 608 Ethereum-format addresses held 551,612 ETH. The FBI’s list and Elliptic’s free blocklist each name addresses holding ETH that the other leaves out.

All times are UTC. Our checks were read-only queries to public endpoints; we ran no exploit code and did not decompile the attacker’s contract.

Timeline of the Binance theft

What the FBI notice says, and what it leaves out

The notice on fbi.gov is four short paragraphs and three address lists. Its structured data gives a publication time of 14:44 UTC on October 31 and a last modification at 21:20 UTC the same day, a day before The Verge reported it. In it the FBI says North Korea “was responsible for the theft of more than $6 billion USD in virtual assets” from Binance. Together with the Secret Service and IRS Criminal Investigation, it has “observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH),” and it urges “THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers” to block transactions with or derived from the listed addresses.

What it does not contain matters as much. There is no intrusion method, no timeline and no evidence for the attribution; The Verge’s summary is that “the agency offered few other details or evidence.” The FBI’s notice on the Bybit theft (published February 26, 2025) used the same TraderTraitor label and asked similar companies to block listed addresses.

The supporting evidence in public comes from the analytics firms. Chainalysis says “the strongest evidence” was watching Binance proceeds commingle with proceeds of last month’s Bitget exploit, which had been attributed to North Korean actors. TRM says it reached its judgment “with high confidence” from on-chain and off-chain intelligence. Elliptic lists service overlaps with three earlier thefts attributed to TraderTraitor, from BigONE, WOO X and AFX. Binance has not named a culprit: none of the ten Binance and Richard Teng posts we read, including the November 1 update, mentions North Korea, TraderTraitor or the FBI.

What the lists contain

The notice ends with three lists: 608 Ethereum-format (0x) addresses, 19 Bitcoin addresses and one Solana address. There are no Tron or XRP Ledger addresses, although TRM counts 612.7 million USDT and 46.4 million TRX stolen on Tron and 233.46 million XRP on the XRP Ledger. The FBI describes the addresses as ones that “are holding or have held assets from the theft”; it does not claim the list is complete, and as shown below it is not.

How Binance’s explanation has changed

Binance’s earliest post we found, at 21:29 UTC on October 29, said its teams were “aware of reports of a potential security issue” and that “user funds are completely safe.” At 02:25 UTC on October 30 it gave the first mechanism: the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” and it had “found no evidence of any wallet private key leak.” Co-CEO Richard Teng added at 07:37 UTC that “the attacker did not simply use one engineer’s permissions” and that the attack was not a single one-click action. By 08:47 UTC Binance said “our subsequent investigation has uncovered additional points of breach.” Its November 1 update promises “a post-incident report with further details on the incident” once the investigation is complete.

Elliptic, summarizing a video update from Teng on October 30, says he described the attack as one that “was not carried out by one person,” said the attacker used a self-destruct mechanism that destroyed tooling and traces, and said the EIP-7702 delegation “did not pass through our normal approval controls.” We have not seen the video, so those lines rest on Elliptic’s account.

The analytics firms read the chain differently from the laptop story. TRM says the pattern “points to a compromise of Binance’s hot wallet signing infrastructure”: on Ethereum the thieves used a delegation, but Binance wallets on the other nine chains sent funds to the attacker “through ordinary signed transfers” within about half an hour, across different chains, key types and signing schemes. Elliptic reaches the same view: “rather than stealing Binance’s private keys, the attacker was able to get Binance’s own systems to sign transactions on their behalf.” That is compatible with Binance’s “no evidence of any wallet private key leak,” but it also means a single laptop cannot be the whole story, which is what Binance now says.

What the chain shows about Binance 14

Elliptic says the Ethereum theft ran through a hot wallet it labels Binance 14. We identified the wallet from the transaction itself, which targets 0x28C6c06298d514Db089934071355E5743bf21d60. Every query below is a read-only call to a public Ethereum endpoint.

One transaction, 50 signatures, one valid

EIP-7702, introduced in Ethereum’s Pectra upgrade in May 2025, lets an ordinary wallet sign an authorization that points its code at a smart contract. The specification says “for each tuple, a delegation indicator (0xef0100 || address) is written to the authorizing account’s code,” so a delegated wallet’s code reads as 0xef0100 followed by the 20-byte contract address. Each tuple must carry the account’s current nonce, and “if any step above fails,” the client skips that tuple and moves to the next one.

Block 26,300,753, timestamped 20:20:59 UTC on October 29, contains a type-4 (EIP-7702) transaction sent by 0x7c86…5ca0 to Binance 14 itself. It carries 50 authorization tuples, all for Ethereum mainnet and all pointing at one contract, 0x63e8…6fae. In the previous block Binance 14’s code was empty; in this one it reads 0xef010063e842b054bd624a465454d533c33f573e9c6fae. The contract holds 1,674 bytes of code.

TRM explains the batch this way: “by preparing signatures for 50 consecutive counts, the attacker guaranteed that one would still be valid when the transaction executed.” The chain adds two details. The nonces run from 18,914,824 down to 18,914,775, listed from highest to lowest; because tuples are applied in list order and each must match the wallet’s nonce at that moment, a high-to-low list lets exactly one tuple through, as long as the nonce falls inside the window, and every lower tuple is stale afterwards. And Binance 14 was sending about 11 transactions a minute: its nonce was already at or above 18,914,775, the lowest value in the batch, by block 26,300,737 (20:17:47 UTC), and stood at 18,914,808 at the end of the block before the attack. That the batch starts at the nonce of about three minutes earlier is our reading; it fits signatures requested around 20:17 UTC, but it cannot tell a stolen key from a signing service that was asked.

The sweep came 3 minutes 24 seconds later

Block 26,300,770 (20:24:23 UTC, 204 seconds after the delegation) contains the sweep. Binance 14’s ETH balance fell from 167,465.25 to exactly 1.0 ETH and its USDT balance from 1,615,409,499 to zero, and the receipt shows transfers of 63 different tokens to a single address, 0x5227…2f8c. That matches TRM’s “167,464 ETH and 63 tokens, including 1.615 billion USDT.” A second hot wallet (0xdFd5…963d, which fits the Binance 16 that TRM and Elliptic describe) fell from 29,459 to 1,453 ETH between blocks 26,300,749 and 26,300,774, the 28,006 ETH TRM says went out by ordinary transfer; we did not trace where it went.

The recipient of the first sweep is blacklisted in both Tether’s and Circle’s contracts. It still holds 1,175,464,713 USDT and 823,000,000 USDC, in line with the roughly 1.18 billion USDT Elliptic says Tether locked in place and the 823 million USDC that TRM and Elliptic say Circle froze. It is on Elliptic’s blocklist and absent from the FBI’s.

The delegation stayed live for 3 hours 49 minutes

We scanned Binance 14’s ETH balance block by block from the delegation onward. It fell to exactly 1.0 ETH five times: at 20:24:23, 21:04:23, 21:44:11, 22:39:35 and 23:56:47 UTC, from 167,465.2, 1,700.9, 370.8, 129.5 and 2,962.9 ETH. TRM also lists sweeps at 20:41 and 20:59 UTC; our ETH-only scan cannot see a sweep that moved only tokens, so we do not vouch for those. TRM adds that Ripple froze RLUSD in the compromised wallet itself “so new deposits could not be swept,” and that World Liberty Financial froze USD1 there at 22:26 UTC. On November 1 Binance 14 was also blacklisted in both Tether’s and Circle’s contracts, with 1,352,018 USDT and 52,363 USDC stuck at the address; Binance 16 was not. We did not determine when those flags were set.

The code at Binance 14 went back to empty in block 26,301,896, timestamped 00:10:35 UTC on October 30. The cause is visible: a type-4 transaction sent from Binance 14 to itself, carrying a single authorization that points at the zero address, which the specification defines as clearing the account’s code. So the delegation lasted 3 hours 49 minutes 36 seconds. That is 2 hours 41 minutes after the earliest Binance post we found and 2 hours 14 minutes before the 02:25 UTC statement that listed “revoked the affected address authorisation” among its precautions. The chain shows that Binance 14’s own key signed the clearing transaction; it does not show who was operating the signing system at that moment.

Reproduce the three key checks

Any archive-capable Ethereum JSON-RPC endpoint works; we used Tenderly’s public gateway for historical state on November 1. Block 26,300,753 is 0x1915151 in hex. This loop asks for Binance 14’s code one block before the delegation, in the delegation block, and now:

for b in 0x1915150 0x1915151 latest; do
  printf "%s -> " $b
  curl -s https://mainnet.gateway.tenderly.co -H "content-type: application/json" --data "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getCode\",\"params\":[\"0x28C6c06298d514Db089934071355E5743bf21d60\",\"$b\"]}"
  echo
done

0x1915150 -> {"id":1,"jsonrpc":"2.0","result":"0x"}
0x1915151 -> {"id":1,"jsonrpc":"2.0","result":"0xef010063e842b054bd624a465454d533c33f573e9c6fae"}
latest -> {"id":1,"jsonrpc":"2.0","result":"0x"}

This one fetches the install transaction and summarizes its authorization list:

curl -s https://mainnet.gateway.tenderly.co -H "content-type: application/json" --data '{"jsonrpc":"2.0","id":1,"method":"eth_getTransactionByHash","params":["0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b"]}' | python -c "
import sys, json
t = json.load(sys.stdin)['result']
a = t['authorizationList']
n = [int(x['nonce'], 16) for x in a]
print('type', t['type'], 'block', int(t['blockNumber'], 16), 'to', t['to'])
print(len(a), 'authorizations; delegate addresses:', sorted({x['address'] for x in a}))
print('nonces', n[0], 'down to', n[-1])"

type 0x4 block 26300753 to 0x28c6c06298d514db089934071355e5743bf21d60
50 authorizations; delegate addresses: ['0x63e842b054bd624a465454d533c33f573e9c6fae']
nonces 18914824 down to 18914775

The third script reads the FBI page, extracts its Ethereum-format addresses and adds up their ETH balances (Python 3, standard library only):

import json, re, urllib.request

UA = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}
URL = "https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack"
page = urllib.request.urlopen(urllib.request.Request(URL, headers=UA)).read().decode()
eth = sorted(set(re.findall(r"0x[0-9a-fA-F]{40}", page)))
print(len(eth), "EVM-format addresses on the FBI page")

RPC = "https://ethereum-rpc.publicnode.com"
total = 0
for i in range(0, len(eth), 80):
    chunk = eth[i:i + 80]
    body = [{"jsonrpc": "2.0", "id": k, "method": "eth_getBalance", "params": [a, "latest"]} for k, a in enumerate(chunk)]
    req = urllib.request.Request(RPC, json.dumps(body).encode(), {"Content-Type": "application/json", **UA})
    total += sum(int(r["result"], 16) for r in json.load(urllib.request.urlopen(req)))
print(round(total / 1e18, 1), "ETH held by those addresses right now")

608 EVM-format addresses on the FBI page
551612.5 ETH held by those addresses right now

The last two lines are what we saw at 19:32 UTC on November 1; your total will differ if the coins have moved.

Where the coins sit now, and whose list covers them

At 19:32 UTC on November 1 (Ethereum block 26,322,034) the coins named in the FBI’s lists were still sitting at those addresses: the Bitcoin balances matched the amount TRM counted as stolen, and the ETH total did not change between our readings at 19:12 and 19:32 UTC. The 19 Bitcoin addresses held 18,270.20 BTC between them (17 hold about 1,000 BTC each, the other two 832.50 and 437.70), against the 18,270 BTC TRM counted as stolen; Elliptic says none of it had yet reached a service. The 608 Ethereum-format addresses held 551,612 ETH, and the five largest hold 488,358 of it, 88.5 percent by our arithmetic. None of the 608 held any USDT or USDC, and none was blacklisted in Tether’s or Circle’s contract, so the stablecoin freezes sit at other addresses, such as the first recipient above. The single Solana address held about 466,694 SOL, against the 970,500 SOL TRM counts as stolen on that chain.

We also downloaded Elliptic’s free blocklist, a CSV that Elliptic says it updates as it traces new addresses, at 19:14 UTC and compared the two lists.

For the Ethereum-format addresses we added up the ETH each set held at block 26,322,034:

Neither list contains the other. The FBI’s list has 151 addresses that Elliptic’s lacks, holding 17,470 ETH (one of them 7,243). Elliptic’s has 2,605 that the FBI’s lacks, holding 45,991 ETH (two of them above 7,000), plus 5,928 Tron addresses where the FBI lists none. Neither list is a statement of ownership: both are likely to include intermediate addresses, and a balance is not proof that an address is attacker-controlled. The practical point is narrower: a screening rule that uses only one list leaves out coins the other names.

Why the headline numbers disagree

The figures differ because they count different things at different times. TRM values each transfer at the price when it was taken; Elliptic leaves out a further $169 million that left Binance after withdrawals were suspended and that it says appears to be Binance moving its own funds, and it counts NEAR as an eleventh chain; and Chainalysis’s page, when we read it on November 1, still carried a template placeholder, “[time] ET,” where the as-of time for its frozen figure should be.

The pile beyond any issuer’s reach differs most between sources. TRM put it at “more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion” on October 30. Elliptic’s November 1 figure is “around $3.25 billion of assets that cannot be frozen by an issuer, spread across more than 800 addresses,” including around 584,000 ETH, 18,327 BTC and 233 million XRP. The snapshots are about two days apart, and Elliptic describes conversions into ETH in between, such as 434 million USDT swapped for 160,451 ETH. Our own count of the FBI list alone, 551,612 ETH and 18,270.20 BTC, sits inside that range.

What defenders can do now

• Screen against both lists, and keep screening. Elliptic says its data show the main Tron distribution wallet sending funds every hour for 31 hours, and warns that “a wallet that screens clean can receive funds from the cluster hours later.” Chainalysis sees “thousands of transactions in a short period” and says the attackers are “using automation to obscure the trail of funds.” A one-off check against a static list is not enough.
• If you run infrastructure the FBI named (THORNode, RPC nodes, instant exchanges, DeFi services), the request is to block transactions with or derived from the listed addresses. Elliptic’s October 31 analysis reported about $31 million swapped into THORChain, at roughly 100 swaps every two hours (data as of 08:11 UTC that day).
• Watch for delegation code on wallets that should have none. TRM’s advice: “Treasury teams should monitor Ethereum-compatible wallets for EIP-7702 delegations, which appear as code at an address that should have none.” The first command above is that check; a result starting with 0xef0100 means the wallet is delegated.
• Treat a signing request for many authorizations as an alarm. TRM: “A request for many authorizations across a range of transaction counts should be treated as an indicator of compromise,” and signing policies should reject EIP-7702 authorizations unless they are expected. Separate signing infrastructure and approval paths “by chain and wallet tier.”
• Rehearse the revocation. Clearing a delegation takes one self-sent type-4 transaction with a zero-address authorization. On Binance 14 it came 3 hours 49 minutes after the install.
• Ask whether any signing path can sign a non-transaction message without the withdrawal approval flow. That is our reading of Teng’s line that the delegation “did not pass through our normal approval controls,” not something Binance has confirmed.

What is still not public

• The way in. Binance says the laptop was not the only point of breach and has promised a post-incident report. Until then, the signing-system reading rests on TRM’s and Elliptic’s assessments of on-chain behavior. The same pattern of developer-side or platform-side access recurs in other incidents we have covered, such as the tampered Claude Code extension served from Cursor’s marketplace and the Northflank breach on Wiz’s October list; Binance has not said how its laptop was compromised, and nothing in the public record ties these incidents together.
• The FBI’s evidence. The notice cites observation of TraderTraitor actors converting assets and nothing else. The public case for attribution is the firms’ on-chain overlap with Bitget and earlier thefts.
• Whether AI is involved in the laundering. Elliptic writes that “whether the automation involves AI agents, rather than conventional scripts, cannot be determined from the on-chain data.”
• Whether the reserve claims hold. Binance says its ten largest balances are fully backed and the outstanding 5 percent sits in less liquid tokens. Its Update #3 says the full zero-knowledge Proof of Reserves is “estimated to be by Tuesday, 2026-11-03 (UTC).”
• Whether the coins move. The 18,270 BTC and 551,612 ETH on the FBI’s list were at those addresses at 19:32 UTC. When they move, the FBI’s blocking request is put to the test.

Sources and method

• FBI: North Korea Responsible for $6 Billion+ Binance Attack and the 2025 Bybit notice.
• Binance and its executives on X: 21:29 post, 02:25 post, Richard Teng, 08:47 update, Update #3, Update #4. Read through the api.fxtwitter.com mirror.
• Analytics firms: TRM Labs, Chainalysis, Elliptic.
• Specification: EIP-7702.
• Press: The Verge, TechCrunch, BleepingComputer, WIRED.

Method: historical Ethereum state came from Tenderly’s public gateway and current balances from PublicNode; Bitcoin balances from Blockstream’s public API and the Solana balance from Solana’s public RPC. The FBI page was parsed for addresses and Elliptic’s CSV was downloaded at 19:14 UTC on November 1. Block times are the blocks’ own timestamps. Balances are as of the times given and will change. We did not verify that any listed address is attacker-controlled beyond the transactions described here.