North Korean state-backed hackers drain $6.36 billion from Binance in history's largest crypto heist
Binance, the world's largest cryptocurrency exchange, is scrambling to restore confidence after hackers stole approximately $6.3 billion in cryptocurrency in what is being described as the biggest crypto heist in history.
The attack, which took place on October 29, saw hackers drain funds from Binance-controlled wallets across 10 blockchain networks, with most of the money disappearing within approximately 20 minutes.
Binance initially suspected that a compromised laptop belonging to one of its DevOps engineers may have provided the attackers with access to internal systems. According to the exchange's preliminary investigation, the attackers used that access to infiltrate a service container and submit unauthorized withdrawal transactions.
However, the company later discovered additional points of breach, suggesting the operation was more sophisticated than initially believed. Interestingly, Binance says investigators have found no evidence that its cryptocurrency wallet private keys were leaked.
Instead, blockchain security researchers believe the attackers compromised the exchange's transaction-signing infrastructure, the systems responsible for approving and authorizing transfers from its wallets.
How the attack worked
Investigations by blockchain intelligence firm TRM Labs revealed that the attackers used a combination of compromised authorization systems and carefully prepared transactions to move the funds.
On Ethereum, one of the targeted networks, the hackers exploited a feature known as EIP-7702 to temporarily let an attacker-controlled program execute transactions from a Binance wallet. The program essentially acted as a digital sweeper, automatically transferring assets to wallets controlled by the attackers.
Similar unauthorized transfers occurred across nine other blockchain networks, pointing to a broader compromise of Binance's wallet infrastructure rather than an isolated vulnerability in one cryptocurrency.
TRM Labs has attributed the attack to TraderTraitor, a hacking group linked to North Korea. The group has previously been linked to major cryptocurrency thefts, although the investigation remains ongoing.
Binance moves to contain the damage
Following the discovery, Binance temporarily suspended withdrawals across affected networks while it conducted security checks. Deposits remained operational. The exchange also worked with cryptocurrency companies to freeze stolen assets before they could be moved beyond recovery.
By October 30, approximately $3 billion had been frozen through cooperation with stablecoin issuers and blockchain networks, including Tether, Circle and Ripple. Unlike Bitcoin, some stablecoins can be frozen remotely by their issuers, making them particularly useful in responding to large-scale thefts.
Binance has promised to cover all losses using its Secure Asset Fund for Users (SAFU) and corporate reserves. The fund was originally established to protect customers in emergencies and holds assets intended to compensate users in situations like this.
