Binance $6.3B Multi-Chain Drain Shows TraderTraitor Access to Signing Infrastructure

TRM Labs traced the operation to a pre-funded operator wallet that spent 36 hours testing malicious code before execution. The Ethereum portion used pre-signed EIP-7702 delegations to hijack a hot wallet; the remaining nine chains required direct control over Binance's multi-scheme signing system. This pattern matches the Bybit and KelpDAO incidents but deviates in laundering tactics, favoring market-maker trades over bridges. The technical evidence establishes centralized signing access rather than individual key theft. Chainalysis linked proceeds to the prior Bitget theft, while ZachXBT and the FBI independently flagged TraderTraitor infrastructure. Official attribution remains unconfirmed by Binance, which cites only the laptop vector. The split highlights how on-chain reuse of mixers and timing clusters provide stronger attribution than public statements alone. The incident reveals that exchange hot-wallet signing clusters remain single points of failure even when private keys stay unexposed. Regulators now face pressure to treat such platforms as critical infrastructure given the scale of frozen stablecoins already exceeding $2.7 billion. Next steps include Tether and Circle expanding freeze lists and potential emergency governance actions on additional chains.