INVESTIGATION DOSSIER / 2026

CWIL / Threat Intelligence Investigation — OperationHot Wallet

THE $6.4 BILLION BINANCE HEISTFive months inside. Four hours to empty it.

A five-month intrusion campaign. Compromised developers. A hijacked signing service. Then one of the most sophisticated cryptocurrency laundering operations ever traced.

SCROLL TO INVESTIGATE

● Case file CWIL-2026-1029 · Briefing

The biggest thefts don't always begin with a zero-day.

The operation did not begin with a spectacular exploit or an obvious perimeter breach. The intrusion chain Binance later reported ran through people, developer machines, internal tools, and finally the infrastructure that authorises cryptocurrency transactions.

Binance's hot wallets were protected by multi-party computation, so no single private key existed to steal. The attackers did not need one. They spent five months working their way to a position where Binance's own signing service would approve their transactions. On the evening of 29 October 2026, it did.

By the time the stablecoin issuers had frozen what they could, the rest was moving across eleven blockchains, thousands of new wallets and dozens of services, mostly heading towards Bitcoin.

VICTIMBinance hot-wallet fleet

ACTORTraderTraitor (DPRK)

WINDOW29 Oct 2026 · 20:05–23:56 UTC

STATUSLaundering ongoing

$6.4B

Reported stolen

Rounded from three estimates that differ only in price snapshots and chain coverage. See the range below.

Binance · TRM Labs · Elliptic

Blockchains hit

Ethereum, Bitcoin, Tron, XRP Ledger, Solana, NEAR, Arbitrum, Optimism, Base, Avalanche and Polygon. TRM counts ten; Elliptic counts eleven.

Elliptic · TRM Labs

5months

Reported intrusion

From a poisoned download in June to the theft on 29 October, over four reported stages of compromise.

Binance incident report, 3 Nov

231min

Drain window

From the first XRP outflow at 20:05 UTC to the last sweep at 23:56 UTC on 29 October. Most of the value left in about 20 minutes.

TRM Labs · Elliptic (on-chain)

$2.85B

Frozen or intercepted

About 94% of it stablecoins blacklisted by their issuers. Nothing on Bitcoin, XRP, Solana or NEAR could be frozen.

Binance · Elliptic

9days

Undetected dwell

Between the pivot through an internal AI tool on 20 October and the theft.

Binance report via BRside, Blockhead

LOSS ESTIMATES
$6.30B → $6.45B

$6.34BBinance $6.36BTRM Labs $6.43BElliptic

Stage 01 — Initial access

A search for a coding tool.

June 2026 · Malvertising · Wallet DevOps team

FIG 01 · Reconstruction · Lookalike sponsored result → tampered installer

What happened

An engineer on Binance's wallet DevOps team searched for a popular AI coding tool. They installed a tampered Homebrew installer from a sponsored lookalike result. Binance's security team detected the compromise, replaced the device and reset the engineer's credentials.

The approach

Malvertising takes advantage of a daily developer habit: search, click, paste an install command. The attacker did not need to reach Binance's network. They only needed to be the first result for a tool engineers were looking for.

Technical read

The machine was cleaned. The intelligence it leaked was not. According to Binance, by the time of detection the attackers had learned who worked on the wallet infrastructure: the engineer's role and their colleagues. That became the target list for every later phase.

Evidence

ReportedBinance incident report (3 Nov) via CNBC, BRside

Analyst note Assessed
Containing a device is not the same as containing a leak. Once one member of a high-value team is compromised, the whole team should be treated as targeted.

Stage 02 — Social engineering

The interview.

September 2026 · Fake recruitment · Malicious coding assessment

FIG 02 · Reconstruction · Three fake personas, one "assignment"

What happened

A second wallet engineer was approached on a job platform by a "Project Director" who referred to their Binance profile. A video interview with a fake "HR" contact followed; that persona had a convincing social media presence. A second interview, with a fake "CEO" in a chat app, ended with a coding "assignment".

The approach

This is the "Contagious Interview" pattern long linked to North Korean operators. It works on ambition and goodwill, and it uses the normality of take-home tests. Each new persona made the process feel more legitimate. The engineer ran the assignment on a work computer.

Technical read

Public analysis of Binance's report says the code replaced the pyenv tool inside Homebrew with a malicious script, so the backdoor ran whenever normal Python tooling was used.
It opened a command-and-control channel to the attacker's server.
It erased its own traces.

Evidence

ReportedBlockhead, CNBC, BRside

Disputed: was it a zero-day? Assessed
Binance described 0-day malware that its endpoint tools missed. Researchers disagreed: on Apple-silicon Macs, /opt/homebrew is writable by the user, so replacing a binary there needs no exploit and no privilege escalation. That is a design weakness, not a zero-day.

Stage 03 — Lateral access

Through the AI tool.

20 October 2026 · Internal tooling abuse · Nine days of dwell

FIG 03 · Reconstruction · One foothold becomes three

What happened

From the second engineer's machine, the attackers used an internal AI tool to reach two more colleagues' computers. One was the June victim's replacement laptop. It held a standing container-deploy token.

The approach

Internal AI assistants are built to be useful, which usually means broad integrations and broad trust. The attackers used that reach to get from one compromised developer to the two machines they needed.

Technical read

Binance has not disclosed how the AI tool was abused, only that it was used to move laterally. Binance has since rebuilt the tool from scratch. After 20 October the attackers went quiet for about nine days. Executing on 11 chains at once on 29 October required knowledge of internal wallet systems, which suggests they spent this time learning them.

Evidence

ReportedBinance report via CNBC, BRsideUnconfirmedThe AI-tool mechanism

Stage 04 — Privilege & signing infrastructure

Don't steal the key. Become the request.

28–29 October 2026 · Staging · Container deployment · Signer abuse

FIG 04 · Reconstruction · MPC signer receiving requests from a rogue container

What happened

On 29 October the attackers worked from a third engineer's computer and used the June engineer's credentials to deploy a container. A script inside it reached Binance's wallet signing service, which then signed transactions "outside the normal withdrawal process".

The approach

Multi-party computation (MPC) splits a key into shares so that no single person or machine holds it. MPC protects the key. It does not check whether the request to sign is legitimate. Anyone who can talk to the signer from a trusted position can get it to sign.

Staging on-chain

28 Oct, morning: three 0.1 ETH withdrawals from Tornado Cash fund a fresh operator wallet.
29 Oct, early: first attack code deployed and tested on two wallets.
29 Oct, 15:59 UTC: final "sweeper" contract deployed and rehearsed on a third wallet. About four hours later it was used against Binance.

Evidence

ConfirmedOn-chain staging (TRM, Elliptic)ReportedContainer and signer path (Binance via BRside)

Binance: "no evidence of any wallet private key leak." Elliptic's assessment is consistent with that: the attackers got Binance's own systems to sign, as with Bybit in 2025.

Stage 05 — Execution

Four hours. Eleven chains.

29 October 2026 · 20:05 → 23:56 UTC · Signed outflows · EIP-7702 hijack

FIG 05 · 3D reconstruction · Hot-wallet vault

The burst

20:05: five XRP Ledger wallets send 233.46M XRP, each left at its minimum reserve.
~20:10: Solana and Optimism drained, including ~970,500 SOL and 44.2M OP.
20:20: the Bitcoin hot wallet sends 18,270 BTC, split in the same block across 19 addresses.
~20:22: Tron hot wallet sends 612.7M USDT + 46.4M TRX.
20:24: "Binance 14" is emptied of 167,464 ETH and 63 tokens, including 1.6B USDT. About $2.53B left in one transaction.
23:05: second wave on Avalanche and Polygon, using plain signed transfers.

The Ethereum twist

EIP-7702 arrived with Ethereum's Pectra upgrade (May 2025). It lets an ordinary account sign an authorization that installs smart-contract code on itself, and that code stays until it is revoked. At 20:20 a single transaction carried 50 authorizations, all signed by the Binance 14 hot wallet, each with a different nonce. One was valid. Binance 14 now ran the attacker's sweeper, which obeyed only the operator wallet.

Why it kept going

Pausing withdrawals stopped Binance's withdrawal system. It did not stop on-chain calls into a delegated wallet. New deposits were swept at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56. Revoking the delegation needed a signature from the same wallet, and under MPC there was no single key to sign it quickly. Binance had to build a dedicated procedure. The large-transfer alert fired only after the main outflows.

Evidence

ConfirmedOn-chain sequence (TRM, Elliptic)ReportedAlerting, MPC revocation (Binance via BRside, Blockhead)

Mechanism — The nonce spray

NONCE nLIVE NONCE → n+17 · SIGNATURE VALIDn+49

01 · PRE-SIGNA hot wallet's nonce goes up with every normal withdrawal, so its value at execution time can't be predicted. The attackers had the signer produce authorizations for 50 consecutive nonces.

02 · SUBMITAll 50 went into one transaction at 20:20 UTC. Whatever the live nonce was, one authorization matched. The wallet's code became the attacker's sweeper.

03 · PERSISTThe delegation outlived the withdrawal pause. Binance 14 was also the executor of a Binance smart account, which the attackers used to pull a further 823M USDC.

How much did EIP-7702 matter? Assessed Ten other chains were drained with ordinary signed transfers, so the root cause is the compromised signer. What EIP-7702 added on Ethereum was persistence: about 3.5 hours of sweeping that survived the withdrawal pause.

Interactive — The full attack path

From a search ad to eleven blockchains.

01 / 11

Malicious developer tooling

June 2026

SCROLL TO ADVANCE · DRAG TO ORBIT · HOVER NODES

Stage 06 — Asset movement

The freeze race.

29–30 October 2026 · Issuer freezes · Stablecoin dumping

Most of the stolen value was issuer-controlled stablecoins, which can be blacklisted at the contract level. From the first minutes, it was a race. The attackers sold freezable assets for ETH at almost any price, while Tether, Circle, Ripple and others tried to freeze them first.

Chart 01 · Stolen value by blockchain

Where the $6.4B was taken from

Tile area is proportional to US dollar value at the time of transfer. Hover or tap a tile for asset units.

Source: TRM Labs (transfer-time prices, as of 30 Oct 00:30 UTC); NEAR value from Elliptic. Confirmed

Chart 02 · Transaction movement timeline

29 October: outflows vs. freezes

Bubble area is proportional to US dollar value. The time axis is stretched between 20:00 and 20:40, when most of the value left.

OutflowFreeze / recovery

← SWIPE TO EXPLORE →

Sources: TRM Labs, Elliptic. The Binance 16 time is approximate (Elliptic: outflows ran ~20:05–20:35). Tether freeze size is 971.1M (TRM) to 1.18B USDT (Elliptic). Confirmed

Blockchain forensics — Chapter 06 continued

Following the money.

Elliptic's latest count: more than 20,000 wallets, 16 blockchains, at least 36 services and 65,000+ transactions. The map below shows every pathway that published on-chain research has established. Hover or tap any node to see its figures and source. Click a node to isolate its paths.

Confirmed transfer Cross-chain bridge Swap / conversion Obfuscation Frozen Unspent Expected / suspected

← SWIPE TO EXPLORE →

Data: Elliptic (to 10 Nov 2026), TRM Labs. Link widths are indicative and not to scale. Exact figures are in each node.

Transfer

Assets move between addresses on the same chain. Fully visible on-chain.

e.g. TRX spray to ~7,700 addresses

Bridging

Assets are locked or burned on one chain and released on another. The link survives, but it has to be followed across chains.

e.g. AVAX → USDC via CCTP

Swapping

One token is exchanged for another on a DEX, an aggregator or with a market maker. Used here to get rid of freezable stablecoins.

e.g. USDT → ETH at a 12–26% loss

Into Bitcoin

BTC is the deepest market for over-the-counter (OTC) desks. This is where DPRK-linked laundering usually ends up.

e.g. XRP → BTC via THORChain

Mixing

Funds are pooled with other users' to break the input→output link. The result is probabilistic, not perfect cover.

e.g. coinjoin, Tornado Cash

OTC liquidity

Brokers trade large blocks off-exchange, often for USDT on Tron. This is the usual exit point.

Expected, not yet observed

Fiat cash-out

Conversion into bank money or cash through brokers and underground banking. It is the step that is hardest to see on-chain.

After Bybit: suspected Chinese OTC

Stage 07 — The laundering operation

Stealing the money was only half the operation.

29 October → ongoing · Automated · 16 chains · 36+ services

The pipeline was clearly automated. Transfers went out every 90 seconds (median), amounts were randomised to six decimals, receiving wallets forwarded funds within 30 seconds to 2 minutes, and every new trading wallet was seeded with exactly 0.5 ETH. Elliptic found no evidence that AI agents were making the decisions, and test transactions and round numbers show that humans were still involved.

Layer 01

Escape the freeze

29–30 Oct · minutes to hours

What happened: About $786M of stablecoins was swapped before the freezes landed, through UniswapX, 1inch and market-maker RFQ systems, at a 12–26% loss. A second wallet put 59.9M USDT into Aave as collateral and borrowed 19,762 ETH. On Tron, 234M USDT became 638M TRX on SunSwap. Around 150 long-tail tokens were sold in time slices (LINK in 89 pieces, PEPE in 94).
Why it matters: Stablecoins can be frozen; ETH and TRX cannot. A 12–26% haircut was cheaper than losing everything.
Observable: Very large, below-market fills by solvers; lending positions opened with stolen collateral.
Uncertain: Which market makers filled the orders, and whether any have since recovered or reported funds.

Layer 02

Wallet distribution

30 Oct 02:19 → 1 Nov 05:33 UTC (Tron)

What happened: A distribution wallet sent 684.6M TRX to about 7,700 new addresses in 1,113 transfers over 51 hours, peaking at about 1,300 transactions an hour. About 725,000 SOL went out in 204 transfers to 77 wallets. NEAR was split into batches of about 400 across about 40 accounts.
Why it matters: Small amounts move prices less, draw less attention from exchange screening, and let the operator set the pace.
Observable: Fan-out from a single source, randomised amounts, short holding times, identical gas seeding.
Uncertain: How many wallets are still dormant and not yet clustered.

Layer 03

Cross-chain movement

30 Oct → early Nov

What happened: At least $147M was bridged off Tron across six or more bridges, mostly ending as ETH. 128M TRX went through a JustLend vault (one deposit address, 16 new withdrawal addresses). Some TRX became USDD, which markets itself as freeze-resistant. AVAX was sold for USDC, bridged with Circle's CCTP and swapped for 7,242.8 ETH. One SOL batch crossed four chains in under five hours.
Why it matters: Each chain hop breaks the trail into separate datasets that have to be matched by amount and timing.
Observable: Bridge deposits and withdrawals matched by value and time. Elliptic has matched about $122M of bridge outputs.
Uncertain: Bridge outputs that have not been matched yet.

Layer 04

Conversion into Bitcoin

from 1 Nov · accelerating

What happened: THORChain became the main route: XRP→BTC, and about 12,200 ETH→BTC (mostly from sold SOL). Bitcoin converted from other stolen assets grew from ~215 BTC (3 Nov) to ~3,350 BTC (~$250M) by 10 Nov. THORChain halted on 31 Oct after a technical fault, which delayed the laundering until 3 Nov. It later halted XRP trading on 7 and 10 Nov.
Why it matters: BTC has the deepest OTC liquidity. After Bybit, all 499,000 stolen ETH was swapped to BTC within ten days.
Observable: Cross-chain swap memos and outbound BTC addresses, which can be clustered.
Uncertain: THORChain node operators have discretion. The FBI has asked them to block these swaps but says it cannot force them to.

Layer 05

Obfuscation

2 → 10 Nov

What happened: Wasabi-style coinjoin rounds took in ~150 BTC (~$11M) by 10 Nov. Tornado Cash took in ~11,000 ETH (~$24M) from 8 Nov, some of it BTC that had already been coinjoined and swapped back to ETH. Privacy Cash took ~$6.7M in ETH and SOL on 3–4 Nov. About 117,000 NEAR was passed through six self-created meme tokens.
Why it matters: Each mixer round trip forces investigators to rely on probabilistic links instead of deterministic ones.
Observable: Deposit timing, amounts and the peel-off pattern after withdrawal.
Uncertain: Which withdrawals belong to the attacker. Mixing hides this by design.

Layer 06

Dormant holdings

unchanged since 29–30 Oct

What happened: The original 18,270 BTC sits in 19 addresses and has not moved. About $1.25B in ETH is spread across ~830 addresses; the nine largest hold 89% and have not moved since 30 Oct. Only about $3M of the ETH has moved.
Why it matters: Patience is part of the method. Bybit's cash-out took months.
Observable: Everything. These are the easiest funds to watch, which is why they haven't been touched.
Uncertain: When they will move, and by which route.

Layer 07

Liquidity & cash-out

expected · months

What happened: As of 10 Nov, Elliptic says only a negligible amount has likely been cashed out. About $16M reached addresses that also hold proceeds from the September 2026 Bitget exploit.
Why it matters: This is the last place defenders can step in: stablecoins in transit and centralised desks screening deposits.
Observable: Deposits into exchanges and known OTC clusters, especially USDT on Tron.
Uncertain: Final proceeds. Following the trail does not show what was eventually converted into fiat.

Chart 03 · Laundering timeline

Ten days of movement

30 OCT 02:19

TRX distribution wallet starts spraying

30 OCT 11:38

AVAX → USDC → CCTP → 7,242.8 ETH

31 OCT 11:34

THORChain halts after a fault; launderers switch bridges

1 NOV 05:33

TRX spray ends: 1,113 transfers over 51 h

2 NOV 02:12

All 233M XRP moved to six new addresses

3 NOV

THORChain resumes; Privacy Cash deposits start

4 NOV

Aave liquidator repays ~9,900 ETH of the attacker's debt

5 NOV

XRP fans out to dozens of accounts → THORChain → BTC

7 NOV

THORChain halts XRP; attacker swaps resume 8 Nov

8–10 NOV

Tornado inflows ~11k ETH; THORChain halts XRP again

Source: Elliptic. Ice-blue markers are disruptions or defender actions. Confirmed

Chart 04 · Conversion into Bitcoin

Bitcoin accumulating, XRP draining

Hover along either chart for exact values.

Source: Elliptic snapshot updates, 2–10 Nov 2026. Confirmed

Stage 08 — Cash-out

The money that hasn't moved yet.

As of 10 November 2026 · OTC exit expected · Final proceeds unknown

44%

Frozen or intercepted, ~$2.85B. Stablecoin blacklists plus the Arbitrum and Optimism governance actions. Confirmed

47%

Still in theft-linked addresses, ~$3.0B. Mostly dormant BTC and ETH. Elliptic considers it "very likely" still held by North Korea. Confirmed

Residual, ~$0.58B. This is $6.43B minus the two figures above: losses on forced swaps, funds already laundered past tracked addresses, and price movement. Assessed

The Bybit precedent

After the February 2025 Bybit theft, North Korea swapped all 499,000 stolen ETH into BTC within ten days. The cash-out took months. Funds were eventually converted to USDT on Tron and cashed out through suspected Chinese OTC services. Elliptic expects the same pattern here.

Who absorbed the loss

Binance says it will cover all customer losses from its SAFU fund and company funds. It reserved $6.34B and reports that 98% of affected balances have been replenished and published Proof of Reserves with a zero-knowledge proof (6 Nov). Withdrawals reopened from 1 Nov, starting with Bitcoin.

ReportedBinance via Blockhead, CNBC

Red-team assessment — The defender's perspective

What should have stopped this?

Eleven control areas. For each one: the opportunity the attacker used, the weakness behind it, where it could have been detected, and the fix. ATT&CK IDs are listed where the reported behaviour supports them.

Evidence locker — Sources & confidence

Every claim, traceable.

Confirmed

Backed by primary documentation (e.g. FBI) or independently verifiable on-chain evidence.

Reported

Published by a credible news outlet or security research firm. Usually relays Binance's report.

Assessed

An analyst interpretation of the available evidence, by CWIL or a cited researcher.

Unconfirmed

Plausible, but cannot currently be established independently.

Source	Date	What it establishes	Class
FBI	31 Oct 2026	Attribution to North Korea's TraderTraitor; funds being converted to ETH; further DeFi and instant-swap laundering expected.	Confirmed
TRM Labs	30 Oct 2026	$6.36B across ten chains; minute-level on-chain timeline; EIP-7702 nonce spray; staging funded via Tornado Cash; freeze times; per-chain values.	Confirmed
Elliptic: the hack	30 Oct – 1 Nov 2026	$6.43B across 11 chains; $2.85B frozen; laundering automation fingerprints; attribution basis (Bitget, BigONE, WOO X, AFX overlaps).	Confirmed
Elliptic: the laundering	to 10 Nov 2026	20k+ wallets; TRX spray; THORChain, coinjoin, Tornado and Privacy Cash flows; BTC accumulation; XRP drawdown; dormant holdings.	Confirmed
CNBC	3 Nov 2026	Richard Teng on the months-long intrusion: tampered Homebrew (June), fake interviews (Sept), internal AI tools; 98% replenished.	Reported
Blockhead	9 Nov 2026	Three-engineer chain; 50 signing transactions and EIP-7702; MPC revocation obstacle; remediation; CFO transition.	Reported
BRside	Nov 2026	Detailed reading of the report: lookalike ad, fake personas, `pyenv` replacement, standing deploy token, late alerting; the "not a zero-day" critique.	Reported Assessed
Binance on X	30 Oct 2026	Initial statement: compromised DevOps laptop → service container; no evidence of a private key leak.	Confirmed
CBS News	Oct 2026	Chainalysis CEO: "likely done" by TraderTraitor; ~$3B frozen; CZ: "User funds are safe!"	Reported
Euronews	30 Oct 2026	Bitquery: 17 hot wallets used; ~$729M in stablecoins swapped before freezes; Binance's containment steps.	Reported
The New York Times	31 Oct 2026	Reporting on the theft and North Korean attribution. (CWIL could not retrieve the full text; no claims here rely on it alone.)	Reported

Scope. This investigation uses public reporting only, as of 10 November 2026. Binance has kept parts of its report confidential, and the laundering is still in progress. CWIL has not reproduced attacker addresses; screen against vendor feeds (TRM, Elliptic, Chainalysis). All visuals are original reconstructions, not documentary imagery.

Epilogue

The blockchain remembers.

Every one of the 65,000+ transactions is a permanent public record. That is why investigators can say exactly where the 18,270 BTC sits tonight. A trail, though, is not a conviction and not a recovery. Following an address does not show who controls it, and following the money does not bring it back. What is left is a public record that defenders, exchanges and investigators will keep checking for years.