CryptoSlate
Binance says investigators found additional breach points in the approximately $6 billion hack, beyond an initially suspected compromised employee laptop. The exchange has not disclosed what those new points were. TRM Labs attributes the attack to North Korea-linked group TraderTraitor, while blockchain investigators traced stolen funds to addresses associated with earlier Bitget and Phemex exploits.
Why it matters
TRM Labs said attackers moved about $6 billion from Binance-associated wallets across 10 blockchains, shifting most of the assets within about 20 minutes. The preparation began at least 36 hours earlier, according to the firm. On Ethereum, the attackers used EIP-7702 to delegate control of a Binance hot wallet to a malicious contract, using one of 50 pre-signed authorizations to install transaction-execution instructions.
TRM said transactions on other networks carried valid signatures, raising the possibility of a compromise involving hot-wallet signing infrastructure. Binance said it found no evidence that wallet private keys were leaked, revoked the affected address authorization and is overhauling its withdrawal infrastructure.
Market impact
Binance says it froze approximately $3 billion in affected assets with help from blockchain partners and will cover all losses through its Secure Asset Fund for Users and corporate resources. Deposits remained unaffected in its Oct. 30 update, which said withdrawals were expected to resume in 45 hours. The exchange also plans to publish an updated proof of reserves after remediation.
TRM Labs said it was highly confident TraderTraitor was responsible, but Binance has not confirmed the attackers' identities. ZachXBT traced funds from the Binance incident and the approximately $388 million Bitget hack to the same Ethereum address after they passed through THORChain. MistTrack separately said stolen TRX passed through Bitget Wallet's cross-chain bridge before reaching an address linked to the Phemex hack. Binance says it is cooperating with law enforcement and blockchain intelligence firms.
Frequently asked questions
-
How did the attackers reportedly access Binance funds?
TRM Labs said the attackers used EIP-7702 to delegate control of a Binance hot wallet to a malicious contract. One of 50 pre-signed authorizations let them install transaction-execution instructions.
-
How much of the affected assets did Binance say it froze?
Binance said it froze approximately $3 billion in affected assets through cooperation with blockchain partners.
-
What does Binance say about customer losses and deposits?
Binance pledged to cover all losses using its Secure Asset Fund for Users and corporate resources. Its Oct. 30 update said deposits remained unaffected.
-
What evidence links the Binance hack to earlier attacks?
ZachXBT traced funds from the Binance and Bitget exploits to the same Ethereum address after they passed through THORChain. MistTrack linked stolen TRX to an address associated with the Phemex hack.
-
Has Binance confirmed who carried out the attack?
No. TRM Labs said it was highly confident TraderTraitor was responsible, but Binance has not confirmed the attackers' identities and says it is cooperating with law enforcement.
CoinDesk
WuBlockchain
CoinTelegraph
TheBlock