# Investigators trace Binance theft to rehearsed attack across at least ten blockchains

_Published Friday, October 30, 2026 at 1:19 PM EDT · Security · Latest · Tier 2 — Notable_

![Investigators trace Binance theft to rehearsed attack across at least ten blockchains — Primary](https://media.wired.com/photos/6ae463bdc091c8b8d1ec019e/191:100/w_1280,c_limit/102026-Binance%20Hacked.jpg)

Investigators traced the Binance cryptocurrency theft to an attack rehearsed before funds were drained across at least ten blockchains, WIRED reported. TRM Labs said most of the theft occurred within around 20 minutes on October 29, with preparations beginning at least 36 hours earlier.

TRM said the attacker tested code on two wallets, rehearsed a final version on a third and installed the same code on a Binance hot wallet four hours after that rehearsal. Hot wallets connect to the internet to handle withdrawals.

TRM and Chainalysis linked the attack potentially to North Korea's TraderTraitor group. Binance said its investigation had uncovered additional breach points beyond a potentially compromised laptop; neither Binance nor law enforcement had named suspected North Korean links.

## Sources

- [wired.com](https://www.wired.com/story/the-dollar63-billion-binance-hack-was-pulled-off-in-just-20-minutes/)

---
Canonical: https://techandbusiness.org/newswire/3zY9qUpnzpkMZxq2kd2iJl
Published: 2026-10-30T17:19:05.595Z
Story chronology: 2026-10-30T11:36:52.444Z
Retrieved: 2026-10-30T19:40:45.193Z
Publisher: Tech & Business (techandbusiness.org)