People get hit by trains. About 1000 fatalities a year in the EU. Bad things happen.
There is still a reason you do not take a nap on the train tracks.
In February 2025, TraderTraitor stole approximately $1.5 billion from Bybit. Five days later, the FBI named the North Korean unit responsible and published the wallets holding the stolen assets.
On Thursday night, the same unit came back. TRM Labs and Chainalysis attribute the Binance theft to TraderTraitor. This time the group took approximately $6.3 billion.
Same actors. Same pattern. A much bigger play.
They executed a seamless attack on Bybit.
Learned lessons, and set their eyes on Binance.
That is a natural escalation.
The threat intelligence would have shown Binance that this was brewing.
The warning already existed. The industry had seen the people, the method and the consequences.
Binance still allowed one compromised laptop to open the floodgates to the enemy.
The play grew from $1.5 billion to $6.3 billion
TraderTraitor is a North Korean state operation built to steal cryptocurrency at industrial scale. The FBI linked it to Bybit. US and Japanese authorities previously linked it to the $308 million theft from DMM Bitcoin. The US Treasury says North Korean cyber units steal and launder digital assets to fund the regime’s weapons programs.
TRM places the Binance operation in the same lineage. The team funded its operator wallet through Tornado Cash, prepared the attack more than a day in advance, tested its code, rehearsed the final version and collected signatures before execution.
Bybit showed the group that a compromise around the signing process could reach cold-wallet authority. Binance gave the group a larger target, more chains and vastly more capital inside the withdrawal path.
The result was the largest cryptocurrency theft ever recorded.
One laptop
Binance’s first incident statement points to a compromised DevOps engineer’s laptop. The intruder used it to reach a service container and submit unauthorized withdrawal transactions. Binance says its investigation found no private-key leak.
Read that again.
One laptop reached a system capable of asking wallets across multiple blockchains to sign away billions of dollars.
People love repeating the line: “You’re only as strong as your weakest link.” After the money disappears, that line gives management somebody to blame.
The employee fucks up. It is the same thing. The employee is part of the system.
Laptops get compromised. People click things. Credentials leak. Sessions get stolen. Developers install software. Someone eventually makes a mistake.
Security exists because those events are inevitable.
Security done right gives people more freedom. It secures the system so they can work, move quickly and make ordinary human mistakes without opening the floodgates to the enemy.
A laptop compromise should end at the laptop. At Binance, the authority travelled from an engineer’s computer into a production container, through the withdrawal infrastructure and into wallets holding billions.
How Binance signed the robbery
The private keys remained inside Binance. Its wallets still produced valid signatures.
That distinction matters.
An attacker holding one stolen Ethereum key could drain one Ethereum wallet. Binance lost assets from Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. Those chains use different keys, formats and signing rules.
The operator reached the layer that knew how to speak to all of them.
Sixteen of the 17 wallets in Bitquery’s reconstruction signed ordinary transfers. The Bitcoin withdrawal paid roughly twice Binance’s usual fee. The Tron and XRP transfers used settings absent from the exchange’s legitimate transactions that night. Binance’s own systems signed each request.
On Ethereum, TraderTraitor went further.
The group used EIP-7702, an Ethereum feature that lets an ordinary wallet delegate its behaviour to smart-contract code. At 20:20 UTC, the operator submitted 50 authorizations already signed by Binance 14, one of the exchange’s busiest hot wallets.
Why 50?
Every Ethereum wallet has a transaction counter called a nonce. Binance 14 was constantly moving, so its nonce kept changing. TraderTraitor prepared authorizations for 50 consecutive values. Forty-nine could miss. One would land.
One landed.
Binance 14 now ran a sweeper contract controlled by the operator. Three minutes and 24 seconds later, the wallet sent away 167,464 ETH and 63 other tokens. The single transaction included 1.615 billion USDT.
New deposits continued reaching Binance 14. The sweeper kept taking them. Six more withdrawals followed over the next three and a half hours.
Binance paused customer withdrawals at 22:33 UTC. The last Ethereum sweep left at 23:56. Binance revoked the EIP-7702 delegation at 00:10.
Customers had been stopped for more than an hour while the attacker’s code was still live inside the wallet.
Twenty minutes
Most of the theft happened in a burst:
20:04 UTC — Five Binance accounts on the XRP Ledger begin sending 233.46 million XRP to a new address.
20:10 UTC — Binance wallets on Solana and Optimism begin to empty.
20:20 UTC — Binance signs away 18,270 BTC. The operator splits it into nineteen addresses, most holding exactly 1,000 BTC. The EIP-7702 authorizations also reach Binance 14.
20:22 UTC — Binance’s Tron wallet sends 612.7 million USDT and 46.4 million TRX.
20:24 UTC — The main Ethereum sweep takes 167,464 ETH, 1.615 billion USDT and 62 additional tokens.
20:30 UTC — Binance wallets on Arbitrum begin to drain.
20:57 UTC — World Liberty Financial freezes WLFI in the main receiving wallet.
21:01 UTC — Tether freezes the main Ethereum receiver. Seven hundred million USDT has already moved onward.
21:04 UTC — Circle freezes 823 million USDC before it moves.
22:33 UTC — Binance pauses withdrawals.
23:56 UTC — Binance 14 sends its final sweep.
00:10 UTC — Binance removes the attacker’s EIP-7702 delegation.
TRM traced approximately $6.36 billion across ten blockchains. Bitquery counted 17 Binance hot wallets in its nine-chain reconstruction.
What left
- Ethereum: approximately $3.79 billion, including 200,630 ETH and 185 other tokens.
- Bitcoin: 18,270 BTC, worth approximately $1.47 billion.
- Tron: 612.7 million USDT and 46.4 million TRX, worth approximately $628 million.
- XRP Ledger: 233.46 million XRP, worth approximately $296 million.
- Solana: approximately 970,500 SOL, worth approximately $96 million.
- Arbitrum, Optimism and Base: approximately $39 million combined.
- Avalanche: approximately $28 million.
- Polygon: approximately $10 million.
The operation converted freezable assets into assets that no issuer could stop. Tether eventually locked approximately 1.76 billion USDT. Circle caught the entire 823 million USDC balance in the main wallet. Other issuers and Arbitrum’s Security Council froze additional assets.
Binance puts the frozen total at approximately $3 billion. Bitquery itemized roughly $2.7 billion.
TraderTraitor converted another $729 million in USDT into Ether and TRX before Tether reached it. The group used UniswapX, 1inch Fusion, Uniswap, Aave and SunSwap. On the largest stablecoin-to-Ether trades, it paid approximately 15 percent above market.
Speed was worth fifteen cents on the dollar. Once the USDT became Ether, nobody could freeze it.
At 06:43 UTC on Friday, Bitquery still saw approximately $3.2 billion under the operator’s control. The largest balances remained parked in fresh wallets: more than 508,000 ETH, 18,270 BTC, 233.46 million XRP and almost one million SOL.
Stop putting the burden on people
The security industry has spent years putting the onus on the employee.
Do not click. Do not install. Do not reuse. Do not expose yourself. You are the weakest link. When it goes wrong, do not come crying to daddy.
That posture is lazy.
A serious system assumes the laptop gets compromised. It limits where that laptop can go, what its identity can reach, what a production service can request and how much any signer can move before another authority intervenes.
Binance’s architecture allowed authority to cross the entire chain:
- A DevOps laptop was compromised.
- The attacker reached a production service container.
- The container could submit withdrawal transactions.
- The withdrawal path could request valid signatures across multiple chains.
- The signers accepted new destinations, unusual transaction structures and enormous values.
- The Ethereum delegation remained active for three hours and 50 minutes.
- The attacker continued sweeping Binance 14 after customer withdrawals had stopped.
The employee fucked up. The system gave that mistake a $6.3 billion blast radius.
That is the failure.
Your fortune is probably sitting inside somebody else’s system
Most family offices, funds and private clients depend on third parties. Exchanges, custodians, banks, wallet providers, cloud platforms, outsourced IT teams and software vendors all sit somewhere between the principal and the asset.
Every dependency imports somebody else’s architecture into your risk.
A logo, licence or institutional sales deck does not tell you whether one compromised endpoint can reach production authority. Marketing language does not tell you whether the signer enforces its own limits. A proof-of-reserves page does not tell you how quickly those reserves can leave.
Binance 14 appeared in the exchange’s proof-of-reserves data. CoinDesk calculated that the theft temporarily reduced Binance’s Ether backing from 100 percent to approximately 94 percent. Binance says its SAFU reserve and company funds will replace every loss.
Proof of reserves showed the assets existed. It could not show that Binance would keep control of them.
Work with third parties that pass serious audits. Our audit methodology stays internal. The principle is public: never hand serious access or capital to a provider simply because everyone else uses it.
Use the exchange. Do not live there.
You park your car in a garage. You do not sleep there.
An exchange is a service. Use it for the activity it exists to perform. Keep capital there when that capital is supporting an active trade.
When you are finished using the service, get the fuck out.
The first question is simple:
Are you in active trades?
If the answer is yes, keep the capital required for those trades on the exchange. Know the amount. Know the reason. Know the exit.
If the answer is no, move the inactive funds to a cold wallet.
Use the exchange like a service. Never use it like your vault.
Why people leave money on exchanges
The usual answer is operational.
They have no system for deploying dry powder quickly. An opportunity appears, cold storage feels slow, and the exchange balance becomes a permanent shortcut.
That shortcut creates permanent exposure.
Build the deployment capability before the opportunity arrives. A serious custody system can keep inactive capital cold and move defined amounts when the investment team needs them. Our clients know how that works. The method stays inside the relationship.
Security done properly creates freedom. The client can trade when the opportunity appears without sleeping inside the garage every night.
Forty-eight hours before Binance
Svperior regularly checks that our clients remain protected.
Forty-eight hours before this particular theft, one of our routine quarterly reminders went out:
“If you’ve got inactive funds on exchanges, pull them to a cold wallet.”
We did not name Binance. We did not claim to predict the exact night. The reminder exists because the exposure exists every day.
Our clients knew the rule. Active trades could remain. Idle capital came home.
They were taken care of.
Make your own decision
TraderTraitor stole $1.5 billion from Bybit. The FBI named the group. The same unit returned and stole $6.3 billion from Binance. Binance says the route began with one compromised laptop.
Take consideration of what you are seeing.
Ask whether your capital is supporting an active trade. Ask what sits on an exchange through habit. Ask which third parties hold authority over your assets and whether anyone has audited the systems behind that authority.
Then make your own decision.