The signer was made to sign: Binance, TraderTraitor and the limits of the freeze

The finding

A North Korean unit has, in the FBI’s assessment, taken more than $6 billion from a single exchange in an afternoon. On 31 October the FBI, with the US Secret Service and IRS Criminal Investigation, attributed the 29 October theft from Binance to the activity it tracks as TraderTraitor ^[11][12]. It is the same name the FBI gave the Bybit theft in February 2025, then put at about $1.5 billion ^[7].

The figure is not the lesson. The mechanism is. Binance reports no evidence that a private key leaked. Its own systems were made to sign what the attacker wanted ^[1][2][3].

What the data says

Binance’s preliminary statement says an attacker reached a service container through a compromised DevOps engineer’s laptop and submitted unauthorised withdrawals. It reports “no evidence of any wallet private key leak” and promises a full post-mortem ^[1]. It later said the investigation had uncovered additional points of breach, without saying where ^[8][12].

The on-chain record fills in the sequence. TRM Labs reports that the operator wallet received three small Tornado Cash withdrawals on 28 October, that the attack code was tested on two wallets and rehearsed on a third, and that it was installed on a Binance hot wallet about four hours after the rehearsal ^[3]. From 20:05 UTC XRP Ledger, Bitcoin and Tron wallets sent funds out through ordinary signed transfers ^[3].

On Ethereum, at 20:20 UTC, the operator submitted one transaction carrying 50 pre-signed EIP-7702 authorisations, each signed by the Binance hot wallet and pointing it at an attacker-controlled sweeper contract. Because the signatures covered 50 consecutive nonces, one was certain to be valid. The balance, including 167,464 ETH and 1.615 billion USDT, was gone in about three and a half minutes ^[3]. Chainalysis and Elliptic describe the same delegation abuse ^[2][4].

EIP-7702 explains why the drain continued. A delegation persists until the account signs a replacement ^[13]. TRM Labs records the attacker sweeping new deposits into the delegated wallet at intervals until 23:56 UTC, with a second wave against Avalanche and Polygon wallets at 23:05 UTC ^[3]. The specification itself warns that changing an account’s delegation “is a security-critical operation that should not be done lightly” ^[13].

TRM Labs reads valid signed transfers across several chains in the same window as pointing to a compromise of Binance’s hot-wallet signing infrastructure, while noting Binance has published no root cause ^[3].

The numbers do not agree

Binance estimates the impact at about $6.3 billion ^[1]. TRM Labs gives $6.36 billion at prices at the time of each transfer, or about $6.23 billion at later prices, across ten blockchains ^[3]. Elliptic gives $6.43 billion across 11 blockchains ^[2]. Chainalysis gives about $6.4 billion ^[4]; an earlier Chainalysis estimate reported in the trade press was $5.912 billion at the time of theft ^[8]. The FBI says more than $6 billion ^[11]. In the first hours, observers cited at least $2 billion and CoinDesk up to $5.7 billion ^[10].

Frozen totals also differ, largely by timestamp: about $2.7 billion as of 00:30 UTC on 30 October (TRM Labs) ^[3], about $2.8 billion (Chainalysis) ^[4], $2.85 billion verified (Elliptic) ^[2] and about $3 billion (Binance) ^[1]. Estimates of what the attacker still holds run from about $2.4 billion (TRM Labs) ^[3] to about $3.25 billion in unfreezable assets across more than 800 addresses (Elliptic) ^[2]. Binance says it has replenished about 90 per cent of the affected amount ^[11][12].

Attribution, and what rests on what

TRM Labs attributed the theft to TraderTraitor “with high confidence”, citing patterns shared with the Bybit and KelpDAO thefts, including small Tornado Cash withdrawals and pre-signed authorisations ^[3]. Chainalysis’s strongest evidence was stolen funds commingling in real time with funds from the September Bitget theft ^[4]. Elliptic initially urged caution over differences in laundering speed and the missing root cause ^[8], then listed shared laundering with Bitget, common service use with earlier TraderTraitor thefts and similarity to Bybit as its basis ^[2]. The FBI statement, as reported, names the activity and the laundering path, primarily conversion into ETH and onward through DeFi and instant-swap services ^[11][12].

Nothing published ties a specific intrusion set to the engineer’s laptop. Two recent primary reports describe how this cluster reaches engineers, and neither is linked to Binance by its authors. Microsoft reports Jade Sleet, one of the names for TraderTraitor ^[9], posing as recruiters for a spoofed AI blockchain intelligence company through three front companies between 8 and 12 June 2026 ^[5]. Zscaler ThreatLabz, at low-to-moderate confidence, links TraderTraitor to a trojanised Terraform provider that delivers the FLATROOF and ROOFDECK backdoors to developer and cloud-engineer machines ^[6].

What it means

A signing system that validates form and trusts the requester is only as strong as the least protected machine allowed to request. Here the requester sat downstream of an engineer’s endpoint ^[1]. The second point is temporal. Chainalysis records freezes beginning at 5:14 p.m. ET, under an hour after funds began leaving at about 4:20 p.m. ET ^[4]. Stablecoins were 94 per cent of what was frozen, and nothing on Bitcoin, XRP Ledger, Solana or NEAR was frozen ^[2]. Recovery capacity was decided by asset mix before the attack began.

Microsoft’s assessment is that North Korean “AI-enabled operations remain human-directed” ^[5]. Elliptic observed 1,113 Tron transfers from one wallet at a median 90-second gap with randomised amounts, and says the data cannot show whether AI agents or ordinary scripts did the work ^[2].

What to do

• Monitor treasury and hot wallets for any EIP-7702 delegation and alert immediately; treat a request for authorisations across a range of nonces as an indicator of compromise ^[3][13].
• Reject unexpected delegation authorisations in signing policy, and separate signing infrastructure and approval paths by chain and wallet tier ^[3].
• Treat engineer endpoints with any path to production signing as part of the signing boundary. Restrict untrusted Terraform providers and verify provider checksums ^[6].
• Brief engineering and recruitment staff on recruiter-themed lures from front companies; Microsoft also advises identity checks and on-camera sessions in hiring ^[5].
• Screen deposits and counterparties against the addresses published for this theft; the FBI has asked providers to block them, and Elliptic, TRM Labs and Chainalysis publish labels ^{[2][3][4][11]}.
• Agree freeze-request contacts with stablecoin issuers and bridge governance bodies before an incident, and know which of your holdings cannot be frozen ^[2][4].

Domain close

This was a cyber operation conducted for revenue, at state scale, through a corporate engineering estate. The FBI’s attribution came two days after the theft, the analytics firms’ within hours ^[4][11]. Speed of attribution did not return the native assets. For any organisation whose systems sign value transfers, the boundary to defend is every machine and identity able to make the signer act, and the delegation primitives a chain offers are part of that boundary ^[3][13].