In partnership with
Introducing Fair Game from Vanity Fair
Join Mark Guiducci for a series of wide-ranging conversations with cultural leaders from the worlds of Hollywood, Politics, Style, Silicon Valley, and beyond.
On every episode, Vanity Fair pulls back the curtain on how some of the most interesting and powerful minds in our society work – and where they see us going. On Fair Game from Vanity Fair, no subject is off limits.
On 29 October someone emptied Binance hot wallets on ten blockchains, most of it in about 20 minutes. TRM Labs puts the haul at $6.36bn, the largest crypto theft on record. On 31 October the FBI named North Korea's TraderTraitor unit and published the addresses holding or having held the money; on 3 November North Korea's state news agency, KCNA, carried Kim Yo Jong's reply calling it "absurd rhetoric and nothing new".
The addresses are public, and so is every transaction behind them. This week: how to read an FBI address list in a free block explorer, what we found when we checked it ourselves on 4 November, and how to file a denial against a ledger anyone can open.
| 28 Oct | Three small Tornado Cash withdrawals fund the attacker's operator wallet | Record |
| 29 Oct | From 20:05 UTC Binance wallets on ten chains empty; 18,270 BTC leaves at 20:20 UTC | Record |
| 29 Oct | 21:01 UTC: Tether freezes 971.1m USDT, 37 minutes after the main Ethereum sweep | Issuer |
| 31 Oct | FBI names TraderTraitor and lists Ethereum, Bitcoin and Solana addresses | FBI |
| 1 Nov | Withdrawals resume; 28 BTC starts moving through WabiSabi coinjoins | Record |
| 3 Nov | KCNA carries Kim Yo Jong's statement calling the FBI claim "absurd rhetoric and nothing new" | KCNA |
| 4 Nov | Our check: three FBI-listed Bitcoin addresses hold 1,000 BTC each, unspent | Record |
$6.36bn taken across ten chains (TRM Labs) | $2.85bn frozen or seized (Elliptic) | 12,000 wallets in under four days (Elliptic) |
The Binance theft was staged in public for 36 hours before it ran
Four FBI-listed Bitcoin addresses, read 4 November 2026. Source: FBI alert of 31 October; mempool.space chain statistics. Signal & Shadow
On the evening of 29 October, wallets belonging to Binance, the world's largest crypto exchange, began sending their balances to addresses controlled by a single attacker. TRM Labs traced about $6.36bn leaving Binance wallets on ten blockchains, most of it in about 20 minutes from 20:05 UTC, with a second wave at about 23:05 UTC. Elliptic, counting 11 chains, puts the total at $6.43bn; the FBI says "more than $6 billion".
How it worked: on Ethereum, the attacker used EIP-7702, which lets an ordinary wallet hand control to a smart contract by signing an authorisation. It submitted one transaction containing 50 pre-signed authorisations at consecutive nonces, so that one would still be valid when it executed. One was, and the Binance hot wallet became a sweeper only the attacker could call. Three minutes and 24 seconds later, a single transaction moved 167,464 ETH and 1.615bn USDT. On the other nine chains, Binance wallets sent funds through ordinary signed transfers in the same window, which TRM reads as a compromise of Binance's hot wallet signing system. Binance co-CEO Richard Teng said the attack hit a hot wallet and that most user assets sit offline in cold storage. Binance initially pointed to a compromised engineer's laptop, and on 3 November confirmed that attackers ran a months-long campaign involving fake recruitment interviews and compromised developer tools to breach the deployment environment.
So when did the open record hold enough to flag this? In hindsight, on the morning of 28 October, when three small Tornado Cash withdrawals funded the operator wallet, and on 29 October, when it deployed and rehearsed its code on test wallets. None of that carried a label at the time. The first moment a monitor could have fired without hindsight was 20:20 UTC on 29 October, when a delegation appeared on a Binance hot wallet: TRM notes that an EIP-7702 delegation shows as code at an address that should have none. Tether froze 971.1m USDT at 21:01 UTC and Circle froze 823m USDC three minutes later.
Open the FBI alert, copy one Bitcoin address straight from the page and paste it into mempool.space. Note what it has received, what it has spent and the time you checked, in UTC, then archive the page. Without the timestamp, your reading is an opinion about a moving target.
This will not be the last one: the FBI attributed the $1.5bn Bybit theft of February 2025 to TraderTraitor in a public alert, and TRM matches this attack's staging to Bybit and to the KelpDAO hack of April 2026. The defenders' side of the record is worth learning from too: issuer freezes within the hour and a public address list within two days.