SockAnalystBinance hot wallet theft (~$6.3B): losses covered, withdrawals resuming in phases
SockAnalyst · Security+ certified analyst.
What happened
At about 20:05 UTC on Oct 29, Binance's hot wallets were compromised and about $6.3B in tokens were withdrawn without authorization. Binance's initial investigation points to a compromised DevOps engineer's laptop that let the attacker reach a service container and submit withdrawal transactions; it says it found no evidence of a private key leak. Binance suspended withdrawals (deposits kept working) and says it will cover all losses from its SAFU fund and company treasury. A technical post-mortem is promised but not yet published.
Update (2026-10-30): Binance Update #2: about 80% of the impacted amount covered with $6.34B set aside; about $3B frozen on-chain with partners.
Update (2026-10-31): Binance Update #3: 90% replenished. Binance says the 7,499 BTC that left its SAFU wallet was the planned SAFU transfer to cover losses. A Proof of Reserves snapshot (00:00 UTC Oct 31) is out.
Update (2026-11-01): Phase one of withdrawals began 06:00 UTC, starting with BTC across 15 networks; Binance says 95% of affected assets are now replenished (CoinDesk).
Update (2026-11-08): Binance's 'Initial Findings and Response Update' post-mortem says the attack chain began in June 2026 when a Wallet DevOps engineer installed a tampered Homebrew build while looking for an AI coding tool, then in September a second engineer ran a fake job-interview 'assignment' that swapped pyenv for a malicious binary. Using an internal AI tool and a container-deployment token left on the first engineer's machine, the attackers reached the wallet-signing service on Oct 29 and used 50 signing transactions to set malicious EIP-7702 delegations on a hot wallet; because the wallet used MPC, revoking them took extra time. Binance puts impact at about $6.34B with about $2.85B frozen or intercepted, and cites the FBI's attribution to North Korea's TraderTraitor. Defenders: allowlist developer tools, hunt for replaced pyenv/Homebrew binaries on engineer Macs, and audit long-lived deployment tokens on endpoints.
Who's affected
Binance users waiting on withdrawals; anyone likely to be targeted by Binance-themed phishing.
✅ Fix / patch
- Only trust binance.com and @binance for the withdrawal restart; ignore 'claim refund' or 'verify your wallet' links.
- Warn users about lookalike Binance domains, fake refund emails and SMS lures this weekend.
- Watch for the full Proof of Reserves (Nov 3) and the technical post-mortem before drawing conclusions.
🔎 Quick hunt check
No published indicators. Hunt for newly registered Binance lookalike domains in DNS/proxy logs and 'Binance withdrawal' / 'refund' lures in mail.
MITRE ATT&CK: T1078, T1199, T1657
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=proxy OR index=dns (query="*binance*" OR dest="*binance*" OR url="*binance*")
NOT (query="*.binance.com" OR query="binance.com" OR dest="*.binance.com")
| stats count dc(src_ip) as clients by query, dest
| sort - countunion isfuzzy=true
(DnsEvents | where Name has "binance" and not(Name endswith "binance.com") | project TimeGenerated, Computer, Name, ClientIP),
(EmailUrlInfo | where Url has "binance" and not(UrlDomain endswith "binance.com") | project TimeGenerated, Url, UrlDomain, NetworkMessageId)
| summarize count() by Name, Url, UrlDomain⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Related playbooks
- Amadeus airline booking breach hits JAL, ANA, Cathay, Singapore Airlines and others · Breach · 2026-10-28
- Chainalysis discloses breach of customer contact data · Breach · 2026-10-30
- MUJI app breach: up to 27.26M customer records · Breach · 2026-10-30
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free