Binance Hot Wallet Drained of 167k ETH via 50 Pre-Signed Nonces After DevOps Laptop Breach
The breach exploited a DevOps laptop to pre-sign 50 nonces on a Binance hot wallet, enabling a $5.9B+ drain without key theft. Attribution to North Korea rests on TTP patterns rather than direct technical proof. SAFU coverage and freezes limit user impact while tracing continues.
Binance reported the incident on Thursday as a security breach impacting $6.3 billion in assets, with nearly $3 billion frozen on-chain by Tether, Circle, and the Arbitrum Security Council. Initial findings point to a DevOps engineer's laptop compromise that granted access to a service container, enabling unauthorized withdrawals without any wallet private key exposure. The exchange plans to cover losses via its SAFU fund and has suspended deposits and withdrawals for 48 hours while revoking affected authorizations and engaging law enforcement.
TRM Labs: At least $1.2B recovered via freezes within 30 days or attribution confidence drops below high.
Sources (3)
- [1]Primary Source(https://thehackernews.com/2026/10/binance-suffers-security-breach.html)
- [2]Supporting Source(https://trmlabs.com/reports/binance-incident-attribution)
- [3]Supporting Source(https://chainalysis.com/blog/binance-heist-estimate)