TheBlock
Blockchain investigators estimate that attackers stole more than $6 billion from Binance on Thursday, in what they describe as the largest crypto hack on record. Binance said its initial investigation pointed to a compromised DevOps engineer's laptop and unauthorized access to a service container. The exchange has not identified a private-key leak, and co-CEO Richard Teng said the attack was more complex than compromising one employee's permissions.
Why it matters
Investigators attributed the attack to North Korean hacking groups, citing advance staging, Tornado Cash withdrawals and pre-signed authorizations. TRM Labs said the attacker prepared at least 36 hours before the theft, testing malicious code on three wallets. On Ethereum, EIP-7702 helped turn a Binance hot wallet into an attacker-controlled sweeper. Coordinated transfers across nine other blockchains point to a broader compromise of hot-wallet signing infrastructure.
The onchain code was relatively simple; the critical access was to systems able to authorize transactions. The breach puts internal infrastructure, access controls and transaction workflows alongside private keys and smart contracts as core parts of exchange security.
Market impact
Binance has approximately $5 billion in affected assets and says it is acquiring another $1.3 billion through market and OTC channels to cover losses. It was working to restore withdrawals and targeted Monday for an initial proof-of-reserves report. Investigators also tracked attempts to move funds into ETH: attackers converted $325 million in stablecoins into $285 million in ETH, while Elliptic said $59.9 million in stolen USDT was deposited into Aave as collateral to borrow 19,762 ETH. Aave said its protocols were unaffected and user positions remained fully collateralized.
TD Cowen analysts said the evidence points to a centralized intermediary's infrastructure, not a failure of Bitcoin or its underlying network. The incident nevertheless raises direct questions about how exchanges secure the operational systems that control access to customer assets.
Frequently asked questions
-
How did attackers reportedly gain access to Binance's hot-wallet systems?
Binance's initial investigation pointed to a compromised DevOps engineer's laptop and unauthorized access to a service container. Investigators said the attack involved wallet-signing infrastructure.
-
What role did EIP-7702 play in the attack?
On Ethereum, the attacker used EIP-7702 to turn a Binance hot wallet into an attacker-controlled sweeper and prepared 50 pre-signed authorizations.
-
How is Binance addressing the affected assets?
Binance has approximately $5 billion in affected assets and says it is acquiring another $1.3 billion through market and OTC channels to cover losses.
-
How did the attacker move some stolen funds into ETH?
The attacker converted $325 million in stablecoins into $285 million in ETH. Elliptic also said $59.9 million in stolen USDT was deposited into Aave as collateral to borrow 19,762 ETH.
-
Were Aave or Bitcoin's underlying network reported as compromised?
Aave said its protocols were unaffected and user positions remained fully collateralized. TD Cowen analysts said available evidence pointed to a centralized intermediary's infrastructure, not a failure of Bitcoin or its underlying network.
WatcherGuru
CryptoSlate
CoinDesk
CoinTelegraph
WuBlockchain