Binance uncovers more breach points in $6 billion hack

Binance said investigators uncovered additional breach points in the approximately $6 billion hack after initially suspecting a compromised employee laptop. The exchange has not disclosed what those additional breach points were.

In an earlier Oct. 30 security update, the exchange said its preliminary investigation identified a potentially compromised DevOps engineer's laptop that may have allowed an attacker to access an internal service container and initiate unauthorized withdrawals.

The disclosure comes as blockchain intelligence firm TRM Labs attributed the incident to North Korea-linked TraderTraitor, while independent investigators identified connections between the stolen funds and previous attacks on Bitget and Phemex.

Binance said it found no evidence of wallet private-key leakage.

According to TRM Labs' Oct. 29 investigation, attackers transferred about $6 billion from Binance-associated wallets across 10 blockchains, moving most of the assets within about 20 minutes.

The affected networks included Ethereum, Bitcoin, Tron, Solana, and the XRP Ledger.

TRM found that the attackers began preparing at least 36 hours before executing the theft, conducting preliminary transactions and deploying malicious code before the main withdrawals.

On Ethereum, TRM said the attacker used EIP-7702 to delegate control of a Binance hot wallet to a malicious contract.

The operation involved 50 pre-signed authorizations, one of which allowed the attacker to install transaction-execution instructions and subsequently drain assets from the wallet.

TRM said wallets on other blockchains executed ordinary transactions bearing valid signatures. It said the coordinated transactions across different networks and signing systems pointed to a possible compromise of Binance's hot-wallet signing infrastructure.

Binance said it had revoked the affected address authorization and was overhauling its withdrawal infrastructure.

The exchange also said it had frozen approximately $3 billion in affected assets through cooperation with blockchain partners and pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and corporate resources.

In its latest Oct. 30 update, Binance said deposits remained unaffected and that it expected withdrawals to resume in 45 hours. The exchange also plans to publish an updated proof of reserves after remediation.