Cryptocurrency exchange Binance is working to determine how hackers managed to steal an estimated $6.3 billion in digital assets across 10 blockchains in a matter of minutes. Blockchain intelligence firms and security analysts have quickly attributed the massive breach to North Korea's state-sponsored TraderTraitor hacking group, citing distinct technical patterns and overlapping fund movements with previous high-profile heists.
Initial statements from Binance pointed toward a compromised laptop belonging to a DevOps engineer, which allegedly allowed unauthorized access to a service container and the submission of withdrawal transactions. However, Binance co-CEO Richard Teng later clarified that the incident involved a far more sophisticated attack process with multiple points of breach rather than a single employee permission failure. During the unfolding security event, automated deposit-wallet sweeps continued to run, inadvertently funneling fresh funds into hot wallets that the attacker had already targeted.
From a technical standpoint, investigators revealed that the attacker leveraged a recent Ethereum network upgrade known as EIP-7702. By preparing pre-signed authorizations prior to the assault, the perpetrator temporarily converted a major exchange hot wallet to run smart contract code, enabling the rapid drainage of assets. Prominent on-chain analysts also noted that stolen funds from the incident were later commingled at identical addresses alongside proceeds from a separate Bitget exploit, further pointing to a unified actor behind both attacks.
Binance has stated that approximately $3 billion of the stolen funds has already been frozen by various third-party partners. The exchange plans to cover all remaining user losses entirely through its Secure Asset Fund for Users and other internal corporate reserves, promising a comprehensive technical postmortem once the ongoing investigation concludes.
Comments