Binance has confirmed a major security incident, initially estimating its impact at approximately $6.3 billion. The exchange says it and its partners have frozen around $3 billion in assets and will cover losses using its SAFU fund and company resources. These are company statements, not a completed independent audit of the consequences. Official Binance announcement
What happened
According to TRM Labs, transfers from Binance wallets began on 29 October at approximately 20:05 UTC. Much of the money moved within roughly twenty minutes. TRM values the stolen assets at $6.36 billion, using prices at the time of the transfers, and describes activity across ten blockchains. Its figures reflect an investigative snapshot as of 00:30 UTC on 30 October, not a final accounting. TRM Labs
Binance’s initial account linked the incident to a compromised DevOps engineer’s laptop, access to a service container and unauthorized withdrawal requests. The company emphasized that it had found no evidence of leaked wallet private keys. That is a more cautious statement than a definitive finding that the keys could not have been compromised under any circumstances. Binance Support
In a subsequent update, Binance reported additional entry points. It described a multistage attack, rather than a situation in which one engineer could transfer all the funds with a single click from one laptop. A full technical post-mortem has not yet been published. Binance News update
Were cold wallets hacked?
The available evidence points to Binance Global’s hot wallets, not a widespread compromise of cold storage. Binance Japan explicitly distinguished the affected global platform’s hot wallets from its own separately managed cold wallets. The Japanese business said it had identified no impact on its customers’ assets. That statement applies specifically to Binance Japan and cannot automatically be extended to every system in the group. Binance Japan
TRM links the Ethereum portion of the attack to EIP-7702 delegation: a hot wallet was made to execute an attacker-controlled contract that swept out assets. On other networks, investigators observed ordinary signed transfers. Their assessment points to compromised signing infrastructure, not a demonstrated break of a cryptographic algorithm. TRM Labs
Ethereum’s documentation warns that EIP-7702 delegation is security-critical because delegated code receives broad control over an account. Keeping a private key secret therefore does not, by itself, rule out losses caused by a dangerous authorization. This explains a risk; it is not evidence that all hardware or cold wallets are vulnerable to the current incident. EIP-7702 specification
Who may be responsible
TRM attributes the attack to the North Korean group TraderTraitor with high confidence. Elliptic also considers North Korean involvement likely, but cautions that overlapping laundering routes can indicate a shared intermediary rather than necessarily the same attacker. The reviewed Elliptic update does not report government-confirmed attribution. TRM Labs, Elliptic
Customer assets and exchange services
A later official Binance News update said the company had reserved more than $6.34 billion of its own funds, excluding frozen assets. According to the exchange, around $5 billion is already held in the affected tokens, while the remaining roughly $1.34 billion is being acquired through market and over-the-counter transactions. It has promised an updated proof of reserves. Binance News on compensation
In the latest reviewed service update, deposits are operating, while withdrawals remain paused. Binance expects withdrawals to resume within 48 hours. That is an estimate, not confirmation that withdrawals have actually restarted. Binance service status
It is important to distinguish stolen, frozen and recovered assets from funds reserved for compensation. Freezing assets limits an attacker’s access but does not, by itself, mean they have been returned to Binance or its customers.
Cold storage is attacked too—but through different mechanisms
Bybit: manipulating a transaction during signing
On 21 February 2025, approximately $1.46 billion in assets was stolen from one of Bybit’s Ethereum multisignature cold wallets. Preliminary findings published on 26 February said compromised Safe developer credentials allowed attackers to interfere with Safe{Wallet} infrastructure and trick signers into approving a malicious transaction. This illustrates an attack on the authorization process for a cold wallet, not proof that cryptography or all cold wallets were broken. Bybit said its other cold wallets were unaffected. Bybit timeline, 26 February investigative update
On 26 February 2025, the FBI officially attributed the theft to North Korea and activity it tracks as TraderTraitor. That differs from the current Binance attribution, which has not yet been confirmed by government authorities in the reviewed sources. FBI
Modified Ledger devices: physical tampering before sale
In a statement dated 15 October 2026, Ledger confirmed an incident in which criminals bought genuine devices, installed hidden hardware components designed to capture the recovery phrase during setup, and put the modified devices back into distribution through resellers in Southeast Asia. The company said its chips, operating system and servers had not been compromised. It characterized the incident as a localized attack on the distribution channel after devices had left its control. Ledger asked authorized partners to suspend sales in Southeast Asia and Hong Kong and tightened product-handling rules. This is a confirmed example of physical tampering with certain hardware wallets, not evidence that all Ledger devices were compromised. Official Ledger statement
15 October is the statement’s publication date, not an established date for a single hack: Ledger describes preparations lasting many months. The reviewed statement does not provide an exact number of affected devices, a complete list of models or a confirmed total loss.
Conclusion
Cold storage reduces certain risks but does not eliminate malicious authorization, theft of a recovery phrase or physical tampering with a device. The separate Bybit and Ledger incidents do not establish that the current Binance attack affected cold wallets.
Comments