Part 1 examined the on-chain mechanics of the 29 October 2026 Binance hot-wallet outflows. This follow-up incorporates Binance’s official preliminary findings and the attribution assessments published by multiple blockchain intelligence firms.
Official Updates from Binance
Binance’s initial investigation points to a compromised DevOps engineer’s laptop as the likely entry point. The device allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. The exchange has stated it found no evidence of any wallet private key leak.
Key confirmed figures and actions:
- Estimated total impact: approximately $6.3 billion across multiple chains.
- Roughly $3 billion frozen on-chain through coordination with stablecoin issuers and other partners.
- All losses will be covered from the Secure Asset Fund for Users (SAFU) and company funds.
- User funds are safe.
- Deposits remain operational. Withdrawals remain paused while a security revamp of the withdrawal service and related addresses is completed, with an expected resumption within 48 hours of the latest update.
- Affected address authorizations have been revoked. Law enforcement and blockchain intelligence partners are engaged for tracing and recovery.
- An updated Proof of Reserves will be published once remediation is complete. A detailed technical post-mortem is still pending.
These statements align with the earlier on-chain picture of valid signatures being used to move funds (including the EIP-7702 delegation observed on Ethereum) without requiring that the private keys themselves were exfiltrated from cold or offline storage.
Attribution Assessments
Several blockchain analytics firms have assessed the incident with high confidence as the work of the TraderTraitor group. TraderTraitor is the same unit previously linked to the February 2025 Bybit incident and the April 2026 KelpDAO hack.
Shared indicators cited by the firms include:
- Small Tornado Cash withdrawals used to fund an operator wallet.
- Staging activity that began at least 36 hours before the main event, including rehearsal transactions.
- Pre-obtained signatures executed in a single burst (on Ethereum this appeared as a transaction containing 50 EIP-7702 authorizations covering consecutive nonces so that at least one would remain valid).
- Rapid movement of freezable assets through market makers and lending protocols immediately after the initial sweeps, followed by the bulk of non-freezable assets (primarily ETH and BTC) remaining in controlled wallets.
TRM Labs published a detailed assessment stating the judgment is made with high confidence based on both on-chain and off-chain intelligence. Chainalysis has likewise assessed the activity as consistent with TraderTraitor. On-chain investigator ZachXBT has described the actor as likely the same group, noting possible fund overlap with a prior incident. Binance itself has not publicly named a perpetrator and continues to work with law enforcement on identification.
The combination of advance signature collection, mixer-funded staging, and the specific operational tempo matches the pattern observed in prior large-scale exchange thefts attributed to the same group. The use of EIP-7702 for the Ethereum portion represents a newer technical choice, but the overall preparation and execution sequence remains consistent.
Current Asset Status
Approximately $2.67 billion in stablecoins has been frozen by Tether, Circle, Ripple, and World Liberty Financial, with additional freezes on Arbitrum. The attacker is reported to retain control of more than 420,000 ETH and 18,270 BTC (roughly $2.4 billion at prevailing prices) plus smaller amounts on other chains. These native assets sit outside issuer blacklisting capability. Chainalysis has estimated the amount stolen at approximately $5.912 billion at the time of the theft.
Implications
The incident demonstrates that sophisticated actors continue to target the operational signing path of large exchanges rather than attempting pure cryptographic breaks. Even when private keys are not directly leaked, compromise of a system that can request or relay valid signatures is sufficient to produce multi-billion-dollar outflows. The rapid issuer freezes limited the convertible portion of the haul, while the confirmed SAFU and corporate coverage commitment reduces residual user exposure.
For threat intelligence teams, the reusable indicators are the Tornado Cash staging pattern, pre-signed authorization batches, and the specific tempo of freezable-asset liquidation. Detection and response playbooks that monitor for these precursors on known hot-wallet addresses remain relevant regardless of the final confirmed identity of the actor.
Source: Binance official statements (X), TRM Labs assessment, Chainalysis commentary, The Hacker News reporting (30 October 2026), and contemporaneous blockchain explorer data.