Binance Halts Deposits and Withdrawals After Suspected $6.3 Billion Breach via Compromised DevOps Laptop

Binance Ethereum Hot Wallets Drained of Over $5.5 Billion via EIP-7702 Delegation Attack

On October 29, attackers drained between $2.5 and $3.5 billion in ETH from Binance hot wallets on Ethereum within 40 minutes, with total losses across Bitcoin and Tron reaching at least $5.57 billion according to Decrypt. The attacker did not steal private keys directly but used EIP-7702 to delegate control of Binance 14 to a malicious contract containing a sweep function that transferred ETH and 63 tokens in a single call. Tether and Circle froze approximately $2.5 billion in USDT and USDC within hours, while Binance stated user funds remain secure. On-chain analysis reveals 18 hours of preparation including three test delegations funded via Tornado Cash, followed by the main delegation and sweep executed in just over three minutes. The attack shares strong operational similarities with previous incidents attributed to TraderTraitor, a subgroup of the North Korean Lazarus group, including gas funding patterns, test runs, and the use of a sweep function. Nearly $1.8 billion in stablecoins was frozen in the first hour, though 195,460 ETH moved to an unmoved address at 0x8532…43D4.

Bitget Loses $351 Million in Record 2026 Crypto Theft After Attackers Forge Internal Transfers

Bitget's hot and warm wallets were drained of approximately $351 million on September 24, marking the largest known single crypto theft of 2026. Attackers did not steal private keys but instead forged internal transfer requests that bypassed approval workflows. The stolen assets spanned at least five blockchains, with the largest portion being roughly 103 million XRP worth about $157 million. Bitget's CEO Gracy Chen attributed the incident to North Korean hackers based on IP patterns, behavioral signatures, and on-chain evidence matching prior operations. The exchange maintains a $464 million user protection fund sufficient to cover all losses, while deposits and trading remain unaffected and only withdrawals are temporarily frozen. The case highlights how process-level compromises can bypass even robust key-management controls in cryptocurrency exchanges.

Address Substitution Attacks Exploit Partial Address Checks in Crypto Wallets

Address poisoning, clipboard hijackers, and supply-chain malware all rely on users verifying only the first and last few characters of long blockchain addresses. Researchers detail real incidents including a May 2024 theft of 1,155 WBTC worth roughly 68 million dollars where an attacker poisoned transaction history after a test transfer. Studies from Carnegie Mellon University show that even security-conscious users miss mismatches in truncated addresses 21 to 38 percent of the time. Existing identicons such as Jazzicon and Blockies can be matched by attackers because they depend on only the first eight hex characters. The team released the open-source Humanized Hash library that renders any address or hash as a 4x4 grid of colored shapes using PBKDF2 stretching, making forgery computationally expensive. Calculations indicate that matching both the visual pattern and edge characters requires tens to millions of GPU-years on current hardware. The library supports multiple languages with identical output and carries an MIT license with a fixed algorithm.