📢 Flash
Bitunix Analyst: Over US$6.3 billion in assets stolen from Binance, exchange custody security tested again
On October 30, the crypto market suffered a dual shock: one was a massive wave of leveraged liquidations; the other was a severe security breach targeting Binance’s multi-chain hot wallet. According to CoinGlass data, a total of 239,224 liquidations occurred within the past 24 hours, with total liquidated value reaching $1.536 billion; the single largest liquidation on Binance’s BTCUSDT perpetual contract amounted to $11.0867 million. Almost simultaneously, TRM Labs detected approximately $6.36 billion in assets transferred across ten blockchains—far exceeding the scale of Bybit’s prior theft incident—and setting a new record for the largest single crypto asset theft to date.
TRM Labs’ analysis indicates that attackers had previously deployed malicious software and exploited Ethereum’s EIP-7702 pre-sign authorization mechanism alongside the signature workflows of hot wallets on multiple public blockchains to execute asset transfers. With “high confidence,” TRM Labs attributes this attack to the North Korean hacking group TraderTraitor. It must be emphasized that this conclusion represents a professional assessment by the security firm based on on-chain behavior and infrastructure characteristics, and has not yet been formally confirmed by any judicial authority or official agency.
On the same day, Binance issued a preliminary investigation report: the incident reportedly originated from the compromise of a DevOps engineer’s personal laptop; attackers used this foothold to infiltrate internal service containers and execute unauthorized withdrawal instructions. To date, no evidence has been found indicating leakage of Binance’s hot wallet private keys. The platform has frozen approximately $3 billion in related assets and explicitly stated it will fully cover losses using its SAFU Fund and proprietary capital. However, on-chain tracking shows that roughly $3.1 billion in assets remains under freely disposable control, predominantly comprising BTC and ETH.
The core risk exposed by this incident lies not in any single key custody failure, but rather in systemic vulnerabilities embedded across the exchange’s overall permission architecture—from endpoint devices and containerized services to transaction signing processes—where insufficient isolation exists. Even if private keys themselves remain uncompromised, once the authorization chain is breached, hot wallets still become conduits for massive asset outflows.
When extreme price volatility triggered by high-leverage liquidations resonates with eroding trust in custodial entities, the risks confronting the market extend beyond conventional volatility metrics and materially penetrate counterparty risk and liquidity discounting dimensions. Key follow-up observation points include: Binance’s progress in restoring withdrawal functionality; whether unfrozen assets continue to move; dynamic changes in the actual frozen amount; and whether Binance’s forthcoming comprehensive technical post-mortem report and reserve audit attestation can effectively restore industry confidence.
TRM Labs’ analysis indicates that attackers had previously deployed malicious software and exploited Ethereum’s EIP-7702 pre-sign authorization mechanism alongside the signature workflows of hot wallets on multiple public blockchains to execute asset transfers. With “high confidence,” TRM Labs attributes this attack to the North Korean hacking group TraderTraitor. It must be emphasized that this conclusion represents a professional assessment by the security firm based on on-chain behavior and infrastructure characteristics, and has not yet been formally confirmed by any judicial authority or official agency.
On the same day, Binance issued a preliminary investigation report: the incident reportedly originated from the compromise of a DevOps engineer’s personal laptop; attackers used this foothold to infiltrate internal service containers and execute unauthorized withdrawal instructions. To date, no evidence has been found indicating leakage of Binance’s hot wallet private keys. The platform has frozen approximately $3 billion in related assets and explicitly stated it will fully cover losses using its SAFU Fund and proprietary capital. However, on-chain tracking shows that roughly $3.1 billion in assets remains under freely disposable control, predominantly comprising BTC and ETH.
The core risk exposed by this incident lies not in any single key custody failure, but rather in systemic vulnerabilities embedded across the exchange’s overall permission architecture—from endpoint devices and containerized services to transaction signing processes—where insufficient isolation exists. Even if private keys themselves remain uncompromised, once the authorization chain is breached, hot wallets still become conduits for massive asset outflows.
When extreme price volatility triggered by high-leverage liquidations resonates with eroding trust in custodial entities, the risks confronting the market extend beyond conventional volatility metrics and materially penetrate counterparty risk and liquidity discounting dimensions. Key follow-up observation points include: Binance’s progress in restoring withdrawal functionality; whether unfrozen assets continue to move; dynamic changes in the actual frozen amount; and whether Binance’s forthcoming comprehensive technical post-mortem report and reserve audit attestation can effectively restore industry confidence.
