Exchange Heist: The $6.34 Billion Binance Theft

On October 29, attackers used Binance’s internal wallet signing service to move about $6.34 billion in digital assets out of its hot wallets, the largest crypto theft on record (Binance). The FBI attributes it to the North Korean activity it calls TraderTraitor. Binance has frozen or intercepted about $2.85 billion and says it will cover the losses itself.

What happened

The attackers spent months working toward the people who could touch Binance’s wallets. The September malware replaced the pyenv tool on engineer B’s work computer with a malicious copy that called out to the attacker, and endpoint protection missed it.

On October 20 the attacker used an internal AI tool, which Binance has not described further, to reach engineers A and C. Engineer A’s machine held a container deployment token. Nine days later the attacker deployed a container whose script made the signing service authorize transfers outside the normal withdrawal process.

TRM counts transfers on ten blockchains, most within about 20 minutes. Fifty more signing requests set up EIP-7702 delegations to an attacker contract, which kept moving funds after Binance suspended withdrawals.

How it could have been caught

Employee devices were the way in, but the theft required new behavior inside Binance’s cloud. A wallet signing service has a short list of callers, and every deploy near it traces to a pipeline run. The first departure was a container deployed with one engineer’s token from another engineer’s device, followed by its first call to the signing service.

What this looks like in Trace

Here is the October 29 deployment traced in Binance’s wallet infrastructure. The token, container, script, signing service, and transfer counts come from Binance. The service hostnames are unpublished, and the workload names, ancestry, AI tool behavior, and timings are illustrative.

Network trace. Workload wallet/ops-task, the attacker’s container. Each row is a tuple Trace’s sensor recorded, checked against the baseline.

AI proxy. If the internal AI tool’s model calls cross the proxy, the October 20 requests stand out nine days before the theft.

Traceback. At T+0:00 the triage agent opens a case and follows the chain:

signing requests → startup script → container deployed with engineer A's token from engineer C's device → no pipeline run, commit, or ticket → AI tool session from engineer B's workstation on Oct 20

Verdict: an outside intrusion that reached the signing service through stolen deploy rights. The case reaches the wallet security team when the container starts, which Binance places before 19:56 UTC, with the token, the device, and the new caller named, ahead of the first transfer at 20:05.

This analysis reconstructs the incident from public reporting and walks through where Trace would have raised the first alert inside Binance’s wallet infrastructure. Detection times are illustrative.