Lazarus Group Behind Record $6.3 Billion Binance Hot Wallet Theft: Anatomy and Cassandra Index Impact
On October 29, 2026, Binance disclosed that attackers had drained digital assets worth roughly $6.3 billion from its hot wallets, marking the largest cryptocurrency exchange theft to date and eclipsing the previous record of $1.5 billion stolen from Bybit in February 2025.
Key Clarification on Hot Wallets
The stolen funds were not customer account balances but tokens held in hot wallets whose private keys reside online to enable instant payouts. Two days later the FBI attributed the operation to the TraderTraitor group, assessed as part of North Korean intelligence and commonly known as the Lazarus Group.
Recovery and Funding Sources
Binance stated that 90 percent of losses were covered, yet this figure refers to replacement of assets purchased with exchange funds rather than direct recovery from the perpetrators. The coverage drew from the SAFU user-protection fund holding approximately $1 billion in Bitcoin, the futures insurance fund, and corporate reserves, totaling roughly $6.34 billion. The ten most liquid assets including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC were restored at 100 percent, while less liquid tokens are being acquired gradually through market and OTC channels.
Attack Mechanics
Initial reports pointed to a compromised DevOps engineer laptop that granted access to a service container and allowed unauthorized withdrawal signatures. Co-CEO Richard Teng later clarified that the intrusion involved sophisticated malware designed to erase forensic traces and slow investigation. TRM Labs blockchain analysis highlighted preparatory activity consistent with earlier incidents at Bybit and KelpDAO, including small test withdrawals through Tornado Cash and pre-obtained signatures executed in a single batch.
Strategic Implications
According to a United Nations panel cited by The Guardian, cryptocurrency thefts between 2017 and 2023 supplied roughly half of North Korea’s foreign currency inflows and potentially financed up to 40 percent of its weapons of mass destruction programs. Former UK National Cyber Security Centre head Ciaran Martin noted that nine- or ten-figure crypto heists have occurred more than thirty times in a decade, while comparable losses at traditional banks remain near zero due to regulatory oversight and rapid freezing mechanisms.
Impact on Cassandra Index
The event registered under criterion D5.2 “Cyber Operations” and added 2.3 percentage points to the weekly movement of the Cassandra Index, which closed at 72. East Asia recorded the sharpest regional increase, rising ten points to 74, reflecting combined effects with North Korean missile tests and drone activity.
Related articles
Binance Confirms Record $6.3 Billion Crypto Theft via Compromised Hot Wallet and EIP-7702
Binance reported on October 30, 2026 that attackers stole approximately 6.3 billion dollars in cryptocurrency, equivalent to roughly 34 billion reais, marking the largest theft in the sector. The unauthorized transfers occurred on October 29 and were completed in about 20 minutes after the attacker compromised the system authorizing withdrawals. According to TRM Labs, the intruder leveraged Ethereum's EIP-7702 feature to seize control of a hot wallet following at least 36 hours of preparation. Initial reports pointed to a compromised DevOps engineer's laptop as the entry point, but the exchange later stated the incident involved multiple factors and was not a single-click action. Roughly 3 billion dollars have been traced, with Tether freezing over 1.57 billion USDT and Circle blocking more than 800 million USDC. Binance has committed to covering all losses through its SAFU fund and internal capital while cooperating with the FBI and U.S. Secret Service. Attribution remains disputed, with TRM Labs and Chainalysis linking the operation to the TraderTraitor group connected to Lazarus, though Binance has not confirmed the perpetrators.
EIP-7702 Explained: How Ethereum's New Signature Standard Enables Persistent Wallet Delegation Attacks
EIP-7702, activated in May 2025 as part of the Pectra upgrade, allows Externally Owned Accounts to delegate execution to smart contract code while retaining their original address and private key. The mechanism introduces powerful features such as batch operations, gas sponsorship, and limited permissions, but also creates new attack surfaces when users sign malicious delegations. Attackers exploit social engineering to obtain EIP-7702 authorizations that install sweeper contracts capable of draining ETH, ERC-20 tokens, and NFTs without further signatures. Unlike ERC-20 approvals, the delegation persists on-chain until explicitly revoked and can affect future incoming funds across multiple networks when chain_id is set to zero. Research from 2026 identified over 900 malicious delegated accounts linked to more than $2.3 million in confirmed losses. The standard itself is not inherently vulnerable; risk stems from unsafe contract implementations and user errors when signing authorizations. Users are advised to verify delegations via Etherscan or eth_getCode and revoke them through trusted wallet interfaces when necessary.
Binance Ethereum Hot Wallets Drained of Over $5.5 Billion via EIP-7702 Delegation Attack
On October 29, attackers drained between $2.5 and $3.5 billion in ETH and tokens from Binance hot wallets on Ethereum within 40 minutes, with the total including Bitcoin and Tron reaching at least $5.57 billion according to Decrypt. The attacker did not steal private keys directly but instead used EIP-7702 to delegate execution code from a malicious contract to Binance 14, allowing a single sweep call to transfer all assets. Tether and Circle froze roughly $2.5 billion in USDT and USDC within the first hours, while Binance stated user funds remain secure and investigations continue. Blockchain analysis reveals 18 hours of preparation including three test runs on external wallets funded via Tornado Cash, followed by the main delegation and sweep in just over three minutes. The attack shares strong operational similarities with previous incidents attributed to TraderTraitor, a Lazarus subgroup, including gas funding patterns, test sweeps, and the use of a sweep function. ETH was moved first to an address that has not yet dispersed funds, while stablecoins were fragmented across new wallets before partial freezes took effect.
Bitget Loses $351 Million in Record 2026 Crypto Theft After Attackers Forge Internal Transfers
Bitget's hot and warm wallets were drained of approximately $351 million on September 24, marking the largest known single crypto theft of 2026. Attackers did not steal private keys but instead forged internal transfer requests that bypassed approval workflows. The stolen assets spanned at least five blockchains, with the largest portion being roughly 103 million XRP worth about $157 million. Bitget's CEO Gracy Chen attributed the incident to North Korean hackers based on IP patterns, behavioral signatures, and on-chain evidence matching prior operations. The exchange maintains a $464 million user protection fund sufficient to cover all losses, while deposits and trading remain unaffected and only withdrawals are temporarily frozen. The case highlights how process-level compromises can bypass even robust key-management controls in cryptocurrency exchanges.