VisionHeight Omnipresence Intelligence Report. Evidence collected 30 October 2026 (UTC). Preliminary: Binance has not yet published its post-mortem.
So we went looking in our own data for exactly that: an operation aimed at Binance's engineers, alive in the weeks before 29 October. One stood up. Most of it was assembled between 5 and 10 October; it was staged onto a single origin in the week before the breach, and taken down within a day of it. Its domains are named for the AWS console, pair Binance's name with AWS, carry an MFA-enrolment pretext, and reach for the engineer's Telegram, iCloud and mailbox too. A Coinbase lure sits on the same server.
Whether this is the operation that emptied the wallets, we cannot say: Binance has not said how the laptop was compromised and has published no network indicators. What we can show is an operation targeting Binance's engineers in the three weeks before the breach, and that every piece of it was visible while it was being built.
The breach, as Binance tells it
Between roughly 20:05 and 23:56 UTC on 29 October, Binance's own withdrawal system signed transfers from 17 of its hot wallets to attacker addresses across ten blockchains, about $6.3 billion in all (wallet count by Bitquery via Euronews; chain count by TRM Labs). Partners froze about $3 billion of it within hours.
Binance's first explanation, at about 02:25 UTC the next morning, was a compromised DevOps engineer's laptop that gave the attacker a service container from which to submit withdrawals; no private key leaked (Binance on X). Within hours the account grew. Co-CEO Richard Teng said the attacker had not simply used one engineer's permissions and that this was no single one-click action, and the company reported additional points of breach, a post-mortem to follow, $6.34 billion set aside to cover losses, and withdrawals back about 48 hours after a security revamp (Richard Teng on X, The Block, The Hacker News).
The on-chain side had its own run-up: the operator wallet was funded through Tornado Cash from 28 October, and the sweeper was tested on three wallets and installed on the Binance hot wallet four hours before the theft (TRM Labs, Blockaid). TRM assesses the attacker ended up able to make Binance's signing system sign whatever it chose, across chains; phished Ethereum authorisations would explain one chain, not ten. Binance has not said how the laptop was compromised and has published no domains, addresses or hashes. TRM Labs and Chainalysis attribute the theft with high confidence to TraderTraitor, a North Korean group; Elliptic has urged caution (via The Hacker News). This report makes no attribution claim of its own.
The hunt
Attacks are built before they are launched. The on-chain side of this one was staged at least 36 hours ahead; the infrastructure side of any intrusion is built earlier still, and in public: domains registered, certificates issued, servers rented and dressed up as something else. Our data records that construction as it happens, so on 30 October we asked one question: in the weeks before the 29th, was anyone building something aimed at Binance's engineers?
The bait. Lookalike domains are the cheapest thing an attacker builds and the hardest to hide, so we pulled every domain registered since August with "binance" in its name: several hundred, nearly two hundred in October. Almost all of it is the usual trade: retail login pages, "register and download" guides in Chinese, fake support desks. One did not belong in that crowd: aws-binance.my.id. Nobody buying crypto types "AWS" next to "Binance". An engineer who signs in to Binance's cloud might.
The address. For two weeks the domain hid behind Cloudflare, where most lookalikes live and die. Then, six days before the breach, it moved to a bare server of its own, 130.12.180.210. We call it Origin B, because it turned out to be the kit's second home. A parked lookalike stays on the CDN; one that gets a server of its own is being given a job. That server carried 22 other domains: AWS console lookalikes, an "implement MFA" page, Telegram, iCloud and mailbox lures, and a Coinbase lookalike that had been waiting since August.
The certificate. One of the console lookalikes had an earlier home. A certificate fingerprint is a search key, and our scans record every address that has ever presented one. Its certificate led to the kit's first home, 144.31.224.139, Origin A: live since early October and dressed up as Google for anyone arriving without the right hostname. Between the two servers we had the kit's whole hosting history.
The telemetry. Pulse Signal describes how datacenter and anonymizing infrastructure is used to reach the internet, and it settled two things. Origin A's earlier life as an exit node in an anonymizer fleet ended in late September, two weeks before the kit's certificate appeared on it, so the pivot is the operator's doing, not fleet noise; and neither server ever scanned or sprayed anything.
The day after. By 30 October the picture was in place. Origin B was dark. Origin A answered every kit hostname with a bare 404. One console lookalike was still live behind Cloudflare and showed how the lures were meant to work: a link carrying three long tokens, a page that stays blank without them, half a megabyte of script with nothing readable in it. The domain with Binance's name on it no longer resolved.
The kit
Thirteen domains, two servers, one target population. Read together, the hostnames describe the person they were built for: someone who signs in to an AWS console for a living, works at a crypto exchange, has an MFA policy to comply with, and keeps a Telegram account, an iCloud account and a personal mailbox worth stealing alongside the corporate ones.
Eleven of the thirteen lures sat behind Cloudflare while the kit was built. de-central-1consoleawsamazon.cloud had a bare origin from day one, which is how the certificate pivot found Origin A, and nl-de-central-2 sat on a third address until the cutover. In the final week ten of the thirteen were pointed at Origin B.
Origin A is an Ace Data Centers address operated by the budget host Play2Go; Origin B is a Netiface LLC address leased through Virtualine Technologies. Both sit in Amsterdam-area datacenters.
The names are the lure. Take eu-central-1.console.aws.amazon.com and remove the dots. That is what these hostnames are: an address that survives a glance in a browser bar. The "webhook challenge server" name is subtler. It reads like a verification endpoint, the kind of link an engineer is told to click to confirm something.
It was bought in three lots. The console set came through NiceNIC and Cloudflare, with privacy on. The five .id lures were bought in one two-hour sitting through an Indonesian registrar, with no privacy at all. The MFA pretext came through a third registrar. Buy each family somewhere else, and a sweep on any single brand sees only a fragment.
It was parked behind Cloudflare while it was built. For the nineteen days of assembly, eleven of the thirteen lures sat behind the CDN; de-central-1 ran on Origin A from day one and nl-de-central-2 on a third address. That is the cheap, safe way to hold inventory: the origin stays hidden, so passive DNS cannot connect the pieces; the certificates are free; scanner traffic is absorbed; a dozen domains can wait for weeks without exposing a server. The price is that leaving the CDN is the moment the pieces can be tied together. That is exactly what happened.
It was staged a week before the breach. Between 18 and 24 October ten of the thirteen domains were pointed at Origin B, and the console set got fresh certificates. A kit being consolidated onto one server and re-certified is a kit about to be used, or already in use.
It was built not to be seen. On scans of 24 and 26 October, Origin A answered a request to the bare address with a self-signed certificate for invalid2.invalid, a server header of gws (Google's own server string) and a redirect to google.com; on 28 October the same port presented the Let's Encrypt certificate for de-central-1. That is the shape of a default host that cloaks and a named host that serves. The live lure went further: three 64-character tokens in the path, a blank page without them, hidden lorem-ipsum blocks to confuse classifiers, and 532 KB of script with a single eval. These are per-victim links. They refuse to render for anyone else, scanners included.
And it was taken down on time. Within a day of the breach Origin B was dark and aws-binance.my.id was out of DNS.
Not only Binance
The oldest piece of the kit is not a Binance lure. csaoicoinbase.com was registered on 19 August, seven weeks before the console set, and moved onto Origin B in the same cutover window as everything else. Whoever built this was working on Coinbase before Binance and kept both in play.
Origin B was a server with other tenants, and a neighbour on a server is not proof of common ownership. Still, the other tenants rhyme: Telegram and "AI coin" download lures, a domain that is an eleven-digit number in the format of a Chinese mobile number, generic authorisation pages, several of them following the same pattern of Cloudflare in front and a short stay on the same server. We note it and do not lean on it. The practical reading is simpler: exchange engineers are a population, not a company, and a defender at any exchange watching for its own brand next to its cloud provider's would have found this server, and on it, the lure meant for the exchange next door.
Could this be the breach?
We saw an operation targeting Binance's engineers in the weeks before the breach. Whether it is the one that got in, we can lay out but not answer. If this kit played a role, it was the first step only: a lure like this yields a credential or a session, not control of a signing system across ten chains.
What would settle it: a post-mortem that names the initial-access vector, or one of these hostnames in the engineer's mailbox or browser history. Until then this is an operation aimed at Binance's engineers, live when Binance's engineer was compromised, and dismantled the day after. Three facts, not a conclusion.
What preemptive means here
Every piece of this kit was visible while it was being built. The domains showed up the day they were registered. The certificates showed up within hours. The move to one server showed up within a day. None of it needed anything from Binance. The kit stood for three weeks before the breach. That is the window preemptive cybersecurity works in: not predicting the attack, but closing the means for it before the first message is sent.
That is what VisionHeight runs for its customers, every day, across the whole internet, with Pulse Signal telling us which servers are already in use and which are being readied. The cluster goes straight to the controls you already run. You hear about the next kit from us, not from a post-mortem. If you run an exchange, or anything else worth a nineteen-day build, we would like to show you what is aimed at you.
For teams that want to look for the next one, this kit leaves a signature:
- Your brand and your cloud provider in one hostname, on a country-code second-level domain, with a wildcard certificate issued within hours of registration
- A regional cloud console endpoint with the dots removed, or a "challenge" or "webhook" verification name on a .cloud domain
- An MFA-enrolment or software-upgrade pretext domain created in the same fortnight as the console lures
- An address that is not Google's answering port 443 as gws and redirecting to google.com
- Three 64-character hexadecimal path segments and a page that stays blank without them
- A bare origin surfacing in passive DNS behind several CDN-fronted lures in the same week
Indicators
All indicators were observed directly by VisionHeight between 5 and 30 October 2026. Co-hosted domains are listed separately and carry lower confidence.
Co-hosted on Origin B, lower confidence: tgchinaversion.online, tgchinaversion.site, aicoindownload.online, aicoindownload.site, 13598809660.net, authorize-x.net, connection-x.com, avocompute.net, 0-1.bid, coffeeland955102.wiki, magpiemyth.online, ofertasmueblesonline.com.
Sources
- Binance on X, 30 October 2026, about 02:25 UTC: initial investigation statement
- Richard Teng on X, 30 October 2026: clarification on the attack process
- The Block, 30 October 2026: $6.34 billion set aside to cover losses
- The Hacker News, 30 October 2026: breach summary, withdrawal-service revamp, Elliptic's caution on attribution
- TRM Labs, 30 October 2026: attribution to TraderTraitor and the on-chain staging timeline
- Blockaid, 30 October 2026: technical reconstruction of the EIP-7702 delegation
- Flare: Binance identities in infostealer logs
- Euronews, 30 October 2026: timeline of Binance's statements and the on-chain record
- VisionHeight Omnipresence Intelligence data: domain registration and WHOIS history, passive DNS, certificate transparency, internet scanning, Pulse Signal telemetry, and live verification on 30 October 2026