defi ·
Binance hack, North Korea linked, attackers drain $6.4 billion via hot-wallet compromise
Investigators have linked the massive $6.4 billion theft from Binance to actors from North Korea.
2 outlets · theblock.co · Decrypt
The breach, the largest in crypto history, began around 4:05 p.m. ET on Thursday, after U.S. markets closed. Attackers moved funds from Binance hot wallets across approximately 10 blockchains, with most transfers occurring within about 20 minutes.
Blockchain analysis firms Chainalysis and TRM Labs determined the total loss to be around $6.4 billion, exceeding the previous record set by the February 2025 Bybit heist by more than four times. The intrusion targeted Binance's internal infrastructure, not the blockchains themselves.
Initially, Binance traced the compromise to a DevOps engineer's laptop, potentially allowing access to a service container for unauthorized withdrawals. However, the exchange later stated its investigation revealed "additional points of breach," with CEO Richard Teng describing "a more complex attack process" that "did not simply use one engineer’s permissions."
On Ethereum, TRM Labs reported that the attacker utilized EIP-7702, a 2025 feature allowing ordinary wallets to temporarily execute smart-contract code. By employing 50 pre-signed authorizations, the attacker transformed a Binance hot wallet into a "sweeper" contract to drain assets, according to TRM Labs.
Both TRM Labs and Chainalysis attributed the hack to TraderTraitor, a North Korean state-linked group also implicated in the Bybit incident. Following the theft, this group converted roughly 84% of the stolen Ethereum into Bitcoin using the Thorchain cross-chain network.
Binance confirmed it will cover all losses using company funds and its emergency reserve, having allocated over $6.34 billion. The exchange has set aside more than $6.34 billion, with about $5 billion already held in the precise tokens stolen, including BTC, ETH, BNB, USDC, and USDT, while acquiring the remainder on open and over-the-counter markets.
Stablecoin issuers responded quickly to the suspected attack. Tether froze over $1.5 billion in USDT assets, and Circle froze approximately $823 million tied to the incident, utilizing their capability to blacklist specific addresses.
Despite the swift actions by issuers, a substantial amount remains inaccessible; the attacker still reportedly controls over 420,000 ETH and 18,270 BTC, plus other tokens, valued at over $3 billion that no issuer can freeze. Security firm Elliptic estimates the hacker still controls around $3.3 billion.
This incident highlights the operational vulnerabilities within centralized custodians, demonstrating that even advanced infrastructure, like the use of EIP-7702 on Ethereum, can be leveraged if the underlying signing infrastructure is compromised.
Market participants and institutions reacted with notable composure; Bitcoin dropped to about $76,400 on Friday, a decline of roughly 4%, and over $1.3 billion in leveraged positions were liquidated.
